CVE-2026-111058 · GHSA-rv4m-xm3f-3ccq

Mercury: Unauthenticated Remote Code Execution via /api/kernels

Risk score: 76/100
CVSS: 9.8 v3.1
Exploit chance (30 days): 0.4%
Published: 19 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Mercury, a Python framework for sharing Jupyter notebooks, has a vulnerability in versions 3.2.5 and below that allows unauthenticated remote code execution via the /api/kernels endpoint. An attacker could exploit this to execute arbitrary Python code.
Affected: {'products': ['Mercury'], 'packages': [{'ecosystem': 'pip', 'name': 'mercury', 'vulnerable': '<= 3.2.5', 'patched': '3.2.6'}]}
Fix: Upgrade to version 3.2.6 or later
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

mercury: Amber, patch this week. A vulnerability in Mercury allows an unauthenticated attacker to execute commands and access data through an interactive operating-system shell. This is due to a missing comma in the BLOCKED_PATTERNS regular-expression literals.

The flaws

CVE-2026-111058: Mercury: Unauthenticated Remote Code Execution via /api/kernels (CVSS 9.8 · EPSS 0%)
CVE-2026-111057: Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass (CVSS 10.0 · EPSS 0%)
CVE-2026-111059: Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML (CVSS 6.1 · EPSS 0%)

The fix

Upgrade mercury: 3.2.6 · 3.2.4 · 3.2.11 or later on your release line

Who is exposed: {'products': ['Mercury'], 'packages': [{'ecosystem': 'pip', 'name': 'mercury', 'vulnerable': '>= 3.0.0, <= 3.2.3', 'patched': '3.2.4'}]}

Where it stands

Public proof of concept

Connects to

Same weakness: Missing authorisation (CWE-862). 399 other warnings in 30 days

Why it is Amber

CVSS 9.8 critical
Remotely exploitable without logging in
On your watchlist: PyPI

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
mercury	pip	<= 3.2.5	3.2.6

References

Original description

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.

Last activity 19 Oct 2026. Patch Forecast updates every hour.