The vulnerability arises because the Mercury framework allowed unauthenticated users to create Jupyter kernels through the /api/kernels endpoint. An attacker can then send execute_request messages that the server executes as arbitrary Python code. Because the endpoint blocklist does not include /api/kernels and the websocket wrapper does not verify executable messages, the flaw results in remote code execution, granting full control over the host system. The underlying weakness is missing authorization.

The affected product is the Mercury Python framework from mljar. Deployments using version 3.2.5 or earlier that are configured without a token permit anonymous access to the /api/kernels API. Any user who can reach that endpoint can craft and execute Python code. The issue is present through version 3.2.5 and was fixed in version 3.2.6.

The CVSS score of 9.8 classifies this vulnerability as CRITICAL. Because authentication is not required, an attacker who can reach the Mercury instance can directly exploit the flaw with a simple HTTP request to /api/kernels. The exploitability is high, and although EPSS data is not provided, the lack of a KEV listing does not reduce the urgency. The vulnerability should be treated with maximum priority.