MLJAR Mercury EUVD-2026-104419

Requires a Mercury deployment (3.0.0 through 3.2.3) that serves content to anonymous/unauthenticated users, since the flaw lies in the anonymous endpoint blocklist that is supposed to shield Jupyter Server from unauthenticated callers. The specific trigger is any HTTP request to the /api/terminals path (e.g. /api/terminals or /api/terminals/1), which the malformed regex fails to match and therefore passes through to Jupyter Server's terminal API. Exploitation also depends on Jupyter Server's terminal feature being enabled/available behind Mercury (the default) so that a shell can actually be opened. Limiting factors: the instance must be network-reachable and running an affected version; upgrading to 3.2.4 fully closes the path. No authentication, user interaction, or non-default configuration beyond ordinary anonymous sharing is required.

All severity signals point the same direction here, making this a genuine top-priority issue rather than CVSS inflation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H = 10.0) is fully supported by the description: a remote, unauthenticated attacker reaches Jupyter Server's terminal API through Mercury's broken anonymous blocklist and obtains an interactive OS shell, yielding full confidentiality, integrity, and availability impact with a scope change (the Mercury blocklist component's failure exposes a distinct Jupyter Server security authority). The root cause is confirmed by source evidence - a missing comma in BLOCKED_PATTERNS concatenating the /lab and /api/terminals regex literals (CWE-185, incorrect regex) - so the technical impact is not speculative. However, several exploitation signals are MISSING, not negative: no EPSS score is provided, the CVE is not listed in CISA KEV, and no public exploit (PoC) was supplied - the GitHub source material is the fix commit, not weaponized exploit code. Therefore active exploitation cannot be claimed. The practical risk is tempered by prevalence: Mercury (mljar) is a niche open-source framework, so the absolute number of exposed instances is likely small, but any internet-exposed instance running anonymous mode on 3.0.0-3.2.3 should be treated as critical and patched immediately.

An attacker locates an internet-reachable Mercury dashboard (versions 3.0.0-3.2.3) that serves notebooks to anonymous users and sends an HTTP request to /api/terminals, which the broken blocklist fails to block. The request reaches Jupyter Server's terminal API, giving the attacker an interactive operating-system shell to run commands and read data as the Mercury process. No public exploit code was provided in the input, but the trivial single-character root cause makes reproduction straightforward once the fix diff is public.