PT-2026-118003

Mercury runs a JupyterLab server with anonymous access by default mercury app/ main .py sets --IdentityProvider.token='' when no --token/MERCURY TOKEN is given; when tokenless it also sets --ServerApp.disable check xsrf=True. It relies on a blocklist mercury app/block handler.py BLOCKED PATTERNS:...