CVE-2026-111059CWE-116CWE-79cross-site-scripting

CVE-2026-111059

Medium · published October 19, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
19.8
In the wild
Unconfirmed
What it is

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active HTML can therefore reach the DOM and execute when another user views the application. This issue is fixed in version 3.2.11.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00284 · 19.8th percentile
Weaknesses
CWE-116 · Improper Encoding or Escaping of Output; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-10-19T21:17Z
References (3)
https://github.com/mljar/mercury/commit/c798a85924e6614c6fea7afe5a560e4554a1d09b · [email protected]https://github.com/mljar/mercury/releases/tag/v3.2.11 · [email protected]https://github.com/mljar/mercury/security/advisories/GHSA-2658-85cv-9wwq · [email protected]
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 16:11Z
    Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
    cvelistv5
  • 19 OCT 16:11Z
    Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
    cvelistv5