{"id":"ghsa-ghsa-f8c7-rwf9-fmgm","seq":2442,"kind":"advisory","title":"Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass","url":"https://github.com/advisories/GHSA-f8c7-rwf9-fmgm","permalink":"https://vulnpulse.app/items/ghsa-ghsa-f8c7-rwf9-fmgm","summary":"影響: pip:mercury >= 3.0.0, <= 3.2.3 → 3.2.4\nSummary A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in mercury_app/block_handler.py is defined as: BLOCKED_PATTERNS = [ # JupyterLab UI + API r\"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.)?\" r\"/api/terminals(?:/.)?\", r\"/api/shutdown(?:/…","severity":"critical","techs":["python"],"cves":["CVE-2026-111057"],"tags":["GHSA-f8c7-rwf9-fmgm","mercury"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-19T17:00:54.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}