PT-2026-118000

Summary A missing comma in mercury app/block handler.py's BLOCKED PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in mercury...