Mercury Jupyter Web Framework Terminal API Bypass Vulnerability

Mercury, a Python framework for sharing Jupyter notebooks as web applications and dashboards, has a terminal API bypass vulnerability.

Affected versions are 3.0.0 through 3.2.4. A missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals, so requests to /api/terminals bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API.

• An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process.
• This issue is fixed in version 3.2.4.