Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

影響: pip:mercury >= 3.0.0, <= 3.2.3 → 3.2.4

A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in mercury_app/block_handler.py is defined as: BLOCKED_PATTERNS = [ # JupyterLab UI + API r"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.)?" r"/api/terminals(?:/.)?", r"/api/shutdown(?:/…

GitHub Advisory Databaseで読む

2026/10/20 02:00、GitHub Advisory Databaseが「Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「緊急」(critical) です。関連する技術: Python。CVE: CVE-2026-111057。