CVE-2026-111059

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active...

Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

Summary Mercury turns Jupyter notebooks into shared web apps/dashboards. The mr.Markdown widget converts its input to HTML with python-markdown and no sanitization step. MarkdownWidget is an ipywidgets.HTML widget, whose value is written to the page as raw HTML via innerHTML with no sanitization,...

CVE-2026-111059

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active...

CVE-2026-111059 Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active...

CVE-2026-111059 Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active...

CVE-2026-111059

The Mercury Python framework, used for sharing Jupyter notebooks, is vulnerable to Stored / DOM Cross-Site Scripting (XSS) in versions 3.0.0 through 3.2.10 . The root cause is that the mr.Markdown component converts attacker-controlled Markdown into HTML without sufficient sanitization before ass...

EUVD-2026-104453

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active...

CVE-2026-111059 Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active...

CVE-2026-111059: Improper Neutralization of Input During Web Page Generation

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active...

PT-2026-117482

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active...

MLJAR mercury: Vulnerability due to improper output processing

The MLJAR Mercury version 3.0.0 to 3.2.11 had a security vulnerability. This vulnerability stemmed from mr.Markdown not cleaning up the original HTML when converting it into HTML, and then assigning that HTML to the ipyWidgets.HTML receiver. This could lead to cross-site scripting attacks. Active...