[aungzayyanaing]

Updates

• CVSS v3
• References

Comments
Add the official marimo 0.23.0 release reference. The release notes list CVE-2026-39987 (Terminal WebSocket Authentication Bypass) and the advisory is fixed in 0.23.0. Reference-only change; no other advisory fields were changed.

[github]

Hi there @mscolnick! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

🟡 Changes recommended

The change removes the advisory’s existing CVSS v3 vector while adding a release reference, altering severity metadata and leaving consumers without a score.

1 open issue

• Preserve the existing CVSS v3 vector · New

What changed in this PR

Updates the Marimo security advisory for CVE-2026-39987 with the official 0.23.0 release reference, but also removes the existing CVSS v3 vector contrary to the stated reference-only scope.

Changes:

• Adds the Marimo 0.23.0 release URL to the advisory references.
• Removes the existing CVSS v3 severity entry while retaining CVSS v4.

File	Description
advisories/​github-reviewed/​2026/​04/​GHSA-2679-6mx9-h9xc/​GHSA-2679-6mx9-h9xc.json	Adds the official Marimo 0.23.0 release reference and removes the existing CVSS v3 severity metadata.

_{Review effort: Lite (dynamic)}

[aungzayyanaing]

Closing this PR: the generated diff unintentionally deletes the advisory's existing CVSS v3 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) while adding the 0.23.0 release reference, so it is not a reference-only change. I will refile a corrected PR that adds only the release reference and preserves CVSS v3.