CRITICAL 10.0 NVD
CVE-2026-111057
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS conc
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.
References
- https://github.com/mljar/mercury/commit/8c467129037ee9df269d543ac217ffd33b97bf3f
- https://github.com/mljar/mercury/releases/tag/v3.2.4
- https://github.com/mljar/mercury/security/advisories/GHSA-f8c7-rwf9-fmgm
This critical severity vulnerability with a CVSS score of 10.0 was published on 2026-10-19 via NVD.
Risk Timeline
CVE Disclosed2026-10-19 · -1 days ago
Remediation Resources
vulnfeed aggregates 17437 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.