CVE-2026-111057

PyPI/mercury CVE-2026-111057: critical 10

Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

Action: Upgrade mercury to 3.2.4 or later.

pip install mercury==3.2.4

Affected

Fixed versions

Sources

• osv: GHSA-f8c7-rwf9-fmgm
• https://github.com/mljar/mercury/security/advisories/GHSA-f8c7-rwf9-fmgm
• https://github.com/mljar/mercury/commit/8c467129037ee9df269d543ac217ffd33b97bf3f
• https://github.com/mljar/mercury
• https://github.com/mljar/mercury/releases/tag/v3.2.4

CVE-2026-111057 · published 2026-10-19T17:00:54Z · modified 2026-10-19T17:15:04.105175540Z · JSON