CVE-2026-111057 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-111057 requires immediate attention.

· 6 min read

Executive Summary

CVE-2026-111057 is a critical unauthenticated remote code execution issue in Mercury (pip mercury), with CVSS 10.0. A missing comma in the blocklist definition causes the /api/terminals endpoint to slip past filtering and reach Jupyter Server’s terminal API. That API can spawn a real interactive OS shell on the host. In practical terms: any network attacker who can reach the service may gain shell access without a login, session, or prior foothold.

This is especially urgent for solo developers and small teams running Mercury in Docker or on exposed hosts. If your deployment is reachable from the internet, treat it as compromised until patched and verified.

Immediate Action

  • Isolate the service now. Remove public exposure immediately: restrict inbound access with firewall rules, security groups, VPN-only access, or reverse-proxy authentication.
  • Patch or upgrade Mercury immediately. Apply the vendor fix as soon as it is available. If no fixed release is published yet, use the code patch below and rebuild/redeploy.
  • Disable terminal access at the edge. Block /api/terminals and /terminals/websocket/ at your reverse proxy or ingress until the fix is confirmed.
  • Assume possible compromise. Review logs for requests to /api/terminals, unusual WebSocket connections, and unexpected shell activity.
  • Rotate secrets if exposed. If the service had internet reachability, rotate API keys, tokens, SSH keys, and any credentials stored on the host.
  • See vendor guidance. Check the Mercury advisory or release notes: Vendor advisory / release notes.

Affected Versions

  • pip mercury 3.2.3 and any earlier version containing the missing-comma blocklist bug are vulnerable.
  • pip mercury <= TODO_FIXED_VERSION vulnerable; upgrade to TODO_FIXED_VERSION or later.
  • pip mercury@latest is safe only if the release includes the blocklist fix and you have verified the deployed image/package version.

Resolution Guide

Python / pip

python -m pip install --upgrade mercury
# or pin to a known fixed version once published:
python -m pip install "mercury>=TODO_FIXED_VERSION"

pipx

pipx upgrade mercury
# or reinstall from a fixed version:
pipx install "mercury>=TODO_FIXED_VERSION"

Docker

docker pull runmercury/mercury:TODO_FIXED_TAG
docker stop mercury
docker rm mercury
docker run --name mercury -p 8888:8888 runmercury/mercury:TODO_FIXED_TAG

Temporary hardening if you cannot patch immediately

# Block terminal endpoints at your proxy/ingress
location ~ ^/api/terminals { deny all; }
location ~ ^/terminals/websocket/ { deny all; }

# If possible, require auth in front of Mercury
# Example: place behind VPN, basic auth, or SSO gateway

Code fix example

BLOCKED_PATTERNS = [
    # JupyterLab UI + API
    r"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.*)?",
    r"/api/terminals(?:/.*)?",
    r"/api/shutdown(?:/.*)?",
    r"/files(?:/.*)?",
]

JavaScript / Java / Linux package managers

No direct npm/yarn/pnpm, Maven/Gradle, apt, or yum package applies to Mercury itself. If Mercury is bundled into a larger app or image, update the container/image or Python dependency that includes Mercury rather than trying to patch through those ecosystems.

Detection & Verification

Check the installed version

python -m pip show mercury
python -c "import mercury; print(getattr(mercury, '__version__', 'unknown'))"

Inspect the vulnerable file

grep -nA5 -B2 'BLOCKED_PATTERNS' mercury_app/block_handler.py

If you see the first two regex strings adjacent without a comma, the deployment is vulnerable.

Check whether the service is exposed

curl -i -X POST http://YOUR_HOST:8888/api/terminals

A vulnerable instance may return a JSON object such as {"name":"1",...} instead of blocking the request.

Verify the fix

# After patching, this should be blocked or denied
curl -i -X POST http://YOUR_HOST:8888/api/terminals

# Confirm the file contains the comma-separated rules
python -c "from pathlib import Path; p=Path('mercury_app/block_handler.py').read_text(); print('/api/terminals(?:/.*)?' in p and ',\n    r\"/api/terminals' in p)"

Log review

  • Search access logs for /api/terminals and /terminals/websocket/.
  • Look for unexpected POST requests followed by WebSocket upgrades.
  • Check for new files, modified notebooks, or unknown processes spawned by the Mercury container/user.

Risk and Impact

This flaw can hand an attacker a live shell on the host running Mercury with no authentication required. From there, they can read notebooks, environment variables, uploaded files, and secrets; alter or delete data; and potentially pivot to other systems on the same network. For small teams, the blast radius is often the entire development environment, shared storage, and any credentials mounted into the container or process.

Bottom line: if Mercury is reachable from untrusted networks, patch or isolate it immediately and verify that /api/terminals is no longer accessible.

Keep reading