CVE-2026-39987 update: How attackers weaponized marimo to deploy a blockchain botnet via HuggingFace

Reported 16 Apr 2026 by otx · Severity: medium

Three days after disclosure of a critical pre-authorization remote code execution vulnerability in the marimo Python notebook platform, multiple threat actors deployed malware hosted on HuggingFace Spaces. A previously undocumented NKAbuse variant was delivered through a typosqua