CVE-2026-111057

10.0 Critique

Publiée le 19/10/2026 à 18:17 · Modifiée le 19/10/2026 à 23:14 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.

Traduire en français

Produits concernés

mljar mercury

Scores CVSS

Version	Score	Source	Vecteur
3.1	10.0 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-185
CWE-284

Références

https://github.com/mljar/mercury/commit/8c467129037ee9df269d543ac217ffd33b97bf3f
https://github.com/mljar/mercury/releases/tag/v3.2.4
https://github.com/mljar/mercury/security/advisories/GHSA-f8c7-rwf9-fmgm

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories