CVE-2026-111057

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.

• CWE-185
• CWE-284

• https://github.com/mljar/mercury/commit/8c467129037ee9df269d543ac217ffd33b97bf3f
• https://github.com/mljar/mercury/releases/tag/v3.2.4
• https://github.com/mljar/mercury/security/advisories/GHSA-f8c7-rwf9-fmgm
• https://github.com/mljar/mercury/security/advisories/GHSA-f8c7-rwf9-fmgm

Published

Oct 19, 2026

Last Modified

Oct 28, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-111046FOSSBilling is an open source billing and client-management …2.3
• CVE-2026-111048FOSSBilling is an open source billing and client-management …8.4
• CVE-2026-11105Insufficient validation of untrusted input in WebUI in Googl…6.5
• CVE-2026-111053FOSSBilling is an open source billing and client-management …6.9
• CVE-2026-111054Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-111056FOSSBilling is an open source billing and client-management …6.9
• CVE-2026-111058Mercury is a Python framework for sharing Jupyter notebooks …9.8
• CVE-2026-111059Mercury is a Python framework for sharing Jupyter notebooks …6.1
• CVE-2026-11106Inappropriate implementation in Media in Google Chrome prior…6.5
• CVE-2026-111061russh is a Rust SSH client and server library that includes …4.3
• CVE-2026-111063AIOHTTP is an asynchronous HTTP client/server framework for …6.3
• CVE-2026-111064AIOHTTP is an asynchronous HTTP client/server framework for …8.2