security
A missing comma opens Mercury's terminal endpoint: two CRITICAL unauth RCEs
A single missing comma in a Python list silently disabled one rule of Mercury's endpoint blocklist, leaving /api/terminals open. Two CRITICAL unauthenticated remote-code-execution flaws let any reachable network client run code on the host with no credentials.