Sploitus

Exploit for CVE-2026-39987

kitploit · 2026-08-30

Exploit Code

MARKDOWN39 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-JASONBERNIER-CVE-2026-39987
# CVE-2026-39987 Exploit POC

## Overview

This repository contains a Proof-of-Concept (POC) script for CVE-2026-39987, a pre-authentication Remote Code Execution (RCE) vulnerability in Marimo. The exploit leverages a WebSocket endpoint to execute arbitrary commands on the target system.

### Vulnerability Details

  * **CVE ID** : CVE-2026-39987
  * **Affected Component** : Terminal WebSocket endpoint (`/terminal/ws`)
  * **Impact** : Unauthorized remote code execution without authentication
  * **Affected Versions** : <= 0.20.4



### Advisory Reference

  * GHSA-2679-6mx9-h9xc



## Prerequisites

  * Python 3.x
  * Required packages: 

root@kitploit:~
        
        pip install websocket-client
        




## Usage

python exploit.py -u <TARGET_URL> [-c ""]  
python exploit.py -u http://example.com:2718 -c "cat /etc/passwd"