GHSA-RV4M-XM3F-3CCQ Mercury: Unauthenticated Remote Code Execution via /api/kernels

Mercury runs a JupyterLab server with anonymous access by default mercuryapp/main.py sets --IdentityProvider.token='' when no --token/MERCURYTOKEN is given; when tokenless it also sets --ServerApp.disablecheckxsrf=True. It relies on a blocklist mercuryapp/blockhandler.py BLOCKEDPATTERNS: /lab,...

CVE-2026-111058

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

CVE-2026-111058 Mercury: Unauthenticated Remote Code Execution via /api/kernels

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

EUVD-2026-104420

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...