Signal is active with 4 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🚨 CVE-2026-111057 (CVSS 10.0 Critical) A missing comma in Mercury concatenated regexes, exposing /api/terminals and giving unauthenticated attackers interactive OS shells. ⚡ Action: Upgrade to >= v3.2.4 immediately (fixes CVE-2026-111058 too). https://t.co/lP6mRIUJPk
🔗 Full Technical Advisory & Attack Chain Telemetry: https://www.thehackerwire.com/vulnerability/CVE-2026-111057/
🚨Critical - Mercury Jupyter Terminal API Access Control Bypass to RCE (CVE-2026-111057) Mercury’s blocked-path regex is malformed in 3.0.0–<3.2.4, letting requests to /api/terminals bypass access controls and hit Jupyter Server’s terminal API. Unauthenticated attackers can spawn an interactive OS shell to run commands and access data as the Mercury process. 👉Affected: mercury 3.0.0 to < 3.2.4 | Upgrade to 3.2.4
A missing comma in Mercury's blocklist merged two regex patterns, leaving /api/terminals and /lab open to unauthenticated shells. Scored 10.0. No exploitation reported. https://severitydaily.com/mercury-cve-2026-111057-missing-comma-blocked-patterns-10-0-cve-2026-111058-3-2-6-no-change/