Vulnerability in Mercury Python Framework Affects Jupyter Notebooks
CVE-2026-111057
10CRITICAL
What is CVE-2026-111057?
A critical security misconfiguration in the Mercury framework, from versions 3.0.0 to 3.2.4, allows unauthenticated attackers to bypass the terminal endpoint's access control. This occurs due to a missing comma in the BLOCKED_PATTERNS configuration, which merges the /lab and /api/terminals regex literals. Consequently, attackers can reach Jupyter Server's terminal API, gaining access to an interactive operating system shell. This vulnerability enables the execution of commands and access to sensitive data handled by the Mercury process. The issue has been addressed in version 3.2.4.
Affected Version(s)
mercury >= 3.0.0, < 3.2.4