Exploit for Missing Authentication for Critical Function in Coreweave Marimo

## https://sploitus.com/exploit?id=1B7D675B-7370-535A-A786-2E909C30EC14
# PoC — CVE-2026-39987 · Marimo Pre-Auth RCE

**CVSS 4.0:** 9.3 (Critical) · `AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H`
**Affects:** marimo  2 calls to `validate_auth()`.
- `terminal.py` -> 0 `@requires`, 0 `validate_auth`.   401 ; `/ws` -> 403 (auth DOES work).
- `/terminal/ws` WITHOUT token -> ACCEPTED. Executed on the server:
    uid=1000() gid=1000() ...
    Linux   ...
  and wrote /tmp/cve_2026_39987_proof.txt -> RCE confirmed.

## Remediation
Upgrade to marimo >= 0.23.0. Temporary mitigation: do not expose `marimo edit`
to untrusted networks; put the editor behind an authenticated proxy; run it
unprivileged / in a container without secrets.

## Disclaimer
For authorized security testing and educational use only. Run it only against
systems you own or have explicit permission to test.