PyPI/mercury CVE-2026-111058: critical 9.8

Mercury: Unauthenticated Remote Code Execution via /api/kernels

Action: Upgrade mercury to 3.2.6 or later.

pip install mercury==3.2.6

Affected

Fixed versions

Sources

• osv: GHSA-rv4m-xm3f-3ccq
• https://github.com/mljar/mercury/security/advisories/GHSA-rv4m-xm3f-3ccq
• https://github.com/mljar/mercury/commit/73a40ceb0becf057f495a5738ad7f5a5222a53e1
• https://github.com/mljar/mercury
• https://github.com/mljar/mercury/releases/tag/3.2.6

CVE-2026-111058 · published 2026-10-19T16:49:08Z · modified 2026-10-19T17:00:04.132793757Z · JSON