Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

影響: pip:mercury >= 3.0.0, <= 3.2.3 → 3.2.4

A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in mercury_app/block_handler.py is defined as: BLOCKED_PATTERNS = [ # JupyterLab UI + API r"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.)?" r"/api/terminals(?:/.)?", r"/api/shutdown(?:/…

Read on GitHub Advisory Database

On 10/20/2026, 02:00 AM, GitHub Advisory Database published "Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass" (type: Advisory). Severity is "Critical" (critical). Related technologies: Python. CVE: CVE-2026-111057.