Mercury is a Python framework that turns Jupyter notebooks into web applications. A missing comma in the BLOCKED_PATTERNS array causes a concatenation of /lab and /api/terminals regular‑expression literals, allowing requests to the terminal API to bypass the anonymous blocklist. An unauthenticated attacker can therefore reach the Jupyter Server’s terminal endpoint and obtain an interactive OS shell with the privileges of the Mercury process, giving full read/write access to the host.

Mercury 3.0.0 through 3.2.4 (inclusive) built by mljar is affected. Versions prior to 3.0.0 and after 3.2.4 are not impacted.

The CVSS score of 10 indicates a critical vulnerability that gives complete control over the host. Because the issue arises from a validation error that is publicly documented, an attacker can target any reachable installation without authentication. The EPSS score is not available but the absence of a KEV listing does not reduce the danger; the flaw is already publicly disclosed and could be used worldwide. An exploitation path consists of sending an unauthenticated HTTP request to /api/terminals, bypassing the blocklist and invoking the Jupyter Server’s terminal API.