https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 07:31:35 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-111058 <p>Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.</p> <p>Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.</p> https://db.gcve.eu/vuln/fkie_cve-2026-111058 https://db.gcve.eu/vuln/ghsa-rv4m-xm3f-3ccq <p><strong>Affected:</strong> PyPI: mercury</p> <p>Mercury runs a JupyterLab server with **anonymous access by default** (`mercury_app/__main__.py` sets `--IdentityProvider.token=&#39;&#39;` when no `--token`/`MERCURY_TOKEN` is given; when tokenless it also sets `--ServerApp.disable_check_xsrf=True`). It relies on a **blocklist** (`mercury_app/block_handler.py` `BLOCKED_PATTERNS`: `/lab`, `/api/terminals`, `/api/shutdown`, `/files`) to keep anonymous users off dangerous Jupyter endpoints.</p> <p>## The vulnerability `/api/kernels` is **NOT** in the blocklist (and cannot be — Mercury needs kernels to run notebooks), and `patch_kernel_websocket_handler()` (`mercury_app/idle_timeout.py`) only tracks the idle-timeout: it wraps `on_message` to call `self.application._timeout_manager.touch()` and then invokes the original handler with **no filtering of `execute_request`**. So any unauthenticated network client can:</p> <p>``` POST /api/kernels {&#34;name&#34;:&#34;python3&#34;} -&gt; 201, returns kernel id open websocket /api/kernels/&lt;id&gt;/channels send an execute_request with arbitrary code -&gt; arbitrary Python execution = RCE ```</p> <p>## Distinct from GHSA-f8c7-rwf9-fmgm (incomplete fix) GHSA-f8c7 was &#34;Unauthenticated RCE via `/api/terminals`&#34; — a missing-comma blocklist bypass. Its fix (add the comma so `/api/terminals` is blocked) does **NOT** address `/api/kernels`, which remains exploitable. The blocklist approach is fundamentally unable to cover kernels, so this is not a variant that another blocklist entry fixes.</p> <p>## Runtime-proven (on the patched version) On…</p> <p><strong>Affected:</strong> PyPI: mercury</p> <p>Mercury runs a JupyterLab server with **anonymous access by default** (`mercury_app/__main__.py` sets `--IdentityProvider.token=&#39;&#39;` when no `--token`/`MERCURY_TOKEN` is given; when tokenless it also sets `--ServerApp.disable_check_xsrf=True`). It relies on a **blocklist** (`mercury_app/block_handler.py` `BLOCKED_PATTERNS`: `/lab`, `/api/terminals`, `/api/shutdown`, `/files`) to keep anonymous users off dangerous Jupyter endpoints.</p> <p>## The vulnerability `/api/kernels` is **NOT** in the blocklist (and cannot be — Mercury needs kernels to run notebooks), and `patch_kernel_websocket_handler()` (`mercury_app/idle_timeout.py`) only tracks the idle-timeout: it wraps `on_message` to call `self.application._timeout_manager.touch()` and then invokes the original handler with **no filtering of `execute_request`**. So any unauthenticated network client can:</p> <p>``` POST /api/kernels {&#34;name&#34;:&#34;python3&#34;} -&gt; 201, returns kernel id open websocket /api/kernels/&lt;id&gt;/channels send an execute_request with arbitrary code -&gt; arbitrary Python execution = RCE ```</p> <p>## Distinct from GHSA-f8c7-rwf9-fmgm (incomplete fix) GHSA-f8c7 was &#34;Unauthenticated RCE via `/api/terminals`&#34; — a missing-comma blocklist bypass. Its fix (add the comma so `/api/terminals` is blocked) does **NOT** address `/api/kernels`, which remains exploitable. The blocklist approach is fundamentally unable to cover kernels, so this is not a variant that another blocklist entry fixes.</p> <p>## Runtime-proven (on the patched version) On…</p> https://db.gcve.eu/vuln/ghsa-rv4m-xm3f-3ccq