Critical Marimo Vulnerability Exploited Within Hours of Public Disclosure

Key Points

• Exploit developed within nine hours of disclosure
• Attacker used unauthenticated terminal endpoint
• Credential-containing files were exfiltrated
• Attack captured by Sysdig honeypot

Full Details

Cloud security firm Sysdig reports that a threat actor built an exploit for a critical-severity vulnerability in Marimo and began using it in attacks approximately nine hours after the bug's public disclosure. The attacker constructed a working exploit directly from the advisory description, connected to the unauthenticated terminal endpoint, and started manual reconnaissance. Sysdig's honeypot captured the attack, showing the threat actor exfiltrating credential-containing files within minutes. This rapid exploitation highlights the urgency of patching critical vulnerabilities immediately upon disclosure. The incident serves as a stark reminder of the speed at which attackers can weaponize publicly available vulnerability information.