CVE-2026-111059

Name of the Vulnerable Software and Affected Versions Mercury versions 3.0.0 through 3.2.10

Description Mercury is a Python framework used to share Jupyter notebooks as web applications and dashboards. The mr.Markdown widget converts input to HTML using python-markdown without a sanitization step. Because the MarkdownWidget subclasses ipywidgets.HTML, it renders its value into the Document Object Model (DOM) as raw HTML via innerHTML without sanitization. When an application passes untrusted data—such as database rows, user submissions, uploaded file contents, or external API responses—to mr.Markdown, it allows for a data-driven stored or DOM-based Cross-Site Scripting (XSS) attack. An attacker can supply malicious HTML or JavaScript, such as event-handler attributes (e.g., onerror or onload), which will execute in the browser of any user who views the application. This can lead to session or token theft, UI spoofing, and unauthorized actions performed as the victim.

Recommendations Update Mercury to version 3.2.11. As a temporary mitigation, avoid passing untrusted or user-controlled data to the mr.Markdown widget.