CVE-2026-111058

9.8 Critique

Publiée le 19/10/2026 à 18:17 · Modifiée le 19/10/2026 à 23:13 · En attente d'analyse NVD · Source : security-advisories@github.com

Description

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.

Traduire en français

Produits concernés

mljar mercury

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-862

Références

https://github.com/mljar/mercury/commit/73a40ceb0becf057f495a5738ad7f5a5222a53e1
https://github.com/mljar/mercury/releases/tag/3.2.6
https://github.com/mljar/mercury/security/advisories/GHSA-rv4m-xm3f-3ccq

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories