{"action":"Upgrade mercury to 3.2.4 or later.","affected":[{"fixed":"3.2.4","introduced":"3.0.0"}],"component":"mercury","cve_ids":["CVE-2026-111057"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["3.2.4"],"ghsa_id":"GHSA-f8c7-rwf9-fmgm","id":"tcs_01M5JJ2JE8AVARHRWHG06J8V7D","modified_at":"2026-10-19T17:15:04.105175540Z","published_at":"2026-10-19T17:00:54Z","references":["https://osv.dev/vulnerability/GHSA-f8c7-rwf9-fmgm","https://github.com/mljar/mercury/security/advisories/GHSA-f8c7-rwf9-fmgm","https://github.com/mljar/mercury/commit/8c467129037ee9df269d543ac217ffd33b97bf3f","https://github.com/mljar/mercury","https://github.com/mljar/mercury/releases/tag/v3.2.4"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-f8c7-rwf9-fmgm","url":"https://osv.dev/vulnerability/GHSA-f8c7-rwf9-fmgm"}],"summary":"Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass"}