Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

影響: pip:mercury >= 3.0.0, <= 3.2.3 → 3.2.4

A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in mercury_app/block_handler.py is defined as: BLOCKED_PATTERNS = [ # JupyterLab UI + API r"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.)?" r"/api/terminals(?:/.)?", r"/api/shutdown(?:/…

GitHub Advisory Database에서 읽기

2026. 10. 20. 오전 02:00, GitHub Advisory Database에서 "Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "긴급"(critical)입니다. 관련 기술: Python. CVE: CVE-2026-111057.