{"id":"CVE-2026-111057","revision":"22a664b98d4d4ad989f08c0399272284","records":[{"revision":"22a664b98d4d4ad989f08c0399272284","observedAt":"2026-10-28T16:46:48.767+00:00","statement":{"source":"cve-program","id":"CVE-2026-111057","aliases":[],"title":"Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass","description":"Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.","state":0,"publishedAt":"2026-10-19T16:04:07.065+00:00","modifiedAt":"2026-10-28T15:31:24.524+00:00","affected":[{"ecosystem":"Vendor product","name":"mercury","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"mljar\",\n                    \"product\": \"mercury\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 3.0.0, < 3.2.4\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":10,"severity":"CRITICAL"}],"references":["https://github.com/mljar/mercury/security/advisories/GHSA-f8c7-rwf9-fmgm","https://github.com/mljar/mercury/commit/8c467129037ee9df269d543ac217ffd33b97bf3f","https://github.com/mljar/mercury/releases/tag/v3.2.4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111057","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-111057","identifiers":["CVE-2026-111057"]},"retained":false,"historicalAffected":[]}],"coverage":[]}