## Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

- 種別: advisory
- 重大度: critical
- 関連技術: python
- CVE: CVE-2026-111057
- 公開日時: 2026-10-19T17:00:54.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-f8c7-rwf9-fmgm)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-f8c7-rwf9-fmgm

影響: pip:mercury >= 3.0.0, <= 3.2.3 → 3.2.4
Summary A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in mercury_app/block_handler.py is defined as: BLOCKED_PATTERNS = [ # JupyterLab UI + API r"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.)?" r"/api/terminals(?:/.)?", r"/api/shutdown(?:/…