{"id":"CVE-2026-111059","title":"Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML","summary":"Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipyw…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79","CWE-116"],"vendor":"mljar","product":"mercury","affected":["mercury >= 3.0.0, < 3.2.11"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-20T15:10:08.190617Z"},"published":"2026-10-19","updated":"2026-10-20","sourceUpdated":"2026-10-20T16:11:40.067Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111059","references":[{"url":"https://github.com/mljar/mercury/security/advisories/GHSA-2658-85cv-9wwq","label":"https://github.com/mljar/mercury/security/advisories/GHSA-2658-85cv-9wwq"},{"url":"https://github.com/mljar/mercury/commit/c798a85924e6614c6fea7afe5a560e4554a1d09b","label":"https://github.com/mljar/mercury/commit/c798a85924e6614c6fea7afe5a560e4554a1d09b"},{"url":"https://github.com/mljar/mercury/releases/tag/v3.2.11","label":"https://github.com/mljar/mercury/releases/tag/v3.2.11"},{"url":"https://github.com/advisories/GHSA-2658-85cv-9wwq"}],"tags":["cve.org","ghsa","pip"],"epss":0.00284,"epssPercentile":0.20764,"aliases":["GHSA-2658-85cv-9wwq"],"ecosystem":"pip","patched":["mercury 3.2.11"],"ingestedAt":"2026-10-19T17:33:42.443Z","slug":"CVE-2026-111059","body":"## Overview\n\nMercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active HTML can therefore reach the DOM and execute when another user views the application. This issue is fixed in version 3.2.11.\n\n## Affected\n\n- `mercury >= 3.0.0, < 3.2.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-111059)\n\nAffected packages:\n\n- `mercury >= 3.0.0, < 3.2.11`\n\nPatched in:\n\n- `mercury 3.2.11`\n\nSource: https://github.com/advisories/GHSA-2658-85cv-9wwq","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}