Skip to content
OpenAdvisories

Vendor

mljar

4 known vulnerabilities.

Products

mercury 3 PlotAI 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-111058 Public exploit

    Mercury: Unauthenticated Remote Code Execution via /api/kernels

    Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The …

    mljar mercury mercury PyPI
  • Critical 10.0
    CVE-2026-111057

    Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

    Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals theref…

    mljar mercury mercury PyPI
  • Critical 9.3
    CVE-2025-1497

    Remote Code Execution in PlotAI

    A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to execute arbitrary Python code. Vendor commented out vulnerable line, further usage of the software requi…

    mljar PlotAI plotai PyPI