CVE-2026-111057
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury.
- No known exploitation
- Severity
- Critical, CVSS 10.0 (v3.1)
- EPSS
- 0.44% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- mercury (pip) >= 3.0.0, <= 3.2.3, fixed in 3.2.4 · GHSA-f8c7-rwf9-fmgm