Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

影響: pip:mercury >= 3.0.0, <= 3.2.3 → 3.2.4

A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in mercury_app/block_handler.py is defined as: BLOCKED_PATTERNS = [ # JupyterLab UI + API r"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.)?" r"/api/terminals(?:/.)?", r"/api/shutdown(?:/…

在 GitHub Advisory Database 阅读

2026/10/20 02:00，GitHub Advisory Database 发布了“Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass”（类型：漏洞公告）。严重程度为“严重”（critical）。相关技术：Python。CVE：CVE-2026-111057。