MARIMO NOTEBOOK FLAW COULD RUN MCP COMMANDS BEFORE CELLS EXECUTE IN EDIT MODE

Summary from the TLDR InfoSec newsletter

Marimo patched CVE-2026-75149 (CVSS 8.8), a code injection flaw in versions before 0.23.15 that let a crafted notebook launch an attacker-controlled MCP server command as a local subprocess the moment the notebook opened in edit mode, before any cell executed, so users should upgrade to 0.24.0.