CVE-2026-111059 in Mercury
Summary
by MITRE • 10/19/2026
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active HTML can therefore reach the DOM and execute when another user views the application. This issue is fixed in version 3.2.11.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified within the Mercury Python framework, specifically affecting versions from 3.0.0 through 3.2.11, represents a critical server-side input validation failure that leads to Cross-Site Scripting (XSS). Mercury is designed to facilitate the conversion of Jupyter notebooks into interactive web applications and dashboards, a process that inherently involves rendering user-provided content as HTML for display in web browsers. The core technical flaw resides within the mr.Markdown component, which processes Markdown syntax by converting it into corresponding HTML structures. In the affected versions, this conversion process fails to adequately sanitize raw HTML tags or attributes before they are assigned to an ipywidgets.HTML sink. This architectural oversight allows malicious actors who can inject controlled Markdown content to embed active HTML elements directly into the rendered output without restriction.
The operational impact of this flaw is significant because it enables stored Cross-Site Scripting attacks against users viewing the generated dashboards or applications. When a user with elevated privileges, such as an administrator or data analyst, views a notebook that contains maliciously crafted Markdown, the unsanitized HTML executes within their browser context. This execution occurs in the same security domain as the Mercury application, allowing attackers to bypass standard Same-Origin Policy restrictions. The vulnerability specifically permits the inclusion of event-handler attributes and other active HTML constructs, which can trigger JavaScript code upon page load or user interaction. Consequently, an attacker could potentially steal session cookies, hijack administrative sessions, perform actions on behalf of the victim, or deface the application interface by manipulating the Document Object Model (DOM).
From a classification perspective, this vulnerability aligns with CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting. The specific mechanism involves the failure to neutralize special characters within HTML tags that are derived from user input before they are processed by the browser's rendering engine. In terms of offensive security frameworks, this behavior maps directly to MITRE ATT&CK technique T1059: Command and Control via Application Layer Protocol, specifically sub-techniques involving web-based command execution or data exfiltration through DOM manipulation. The attack vector is typically classified as Remote (Network) with Low Complexity, requiring only that the attacker can inject Markdown content into a notebook accessible to other users within the Mercury environment.
Mitigation for this vulnerability requires immediate upgrading of the Mercury framework to version 3.2.11 or later, where the issue has been resolved through improved sanitization logic in the mr.Markdown component. For organizations unable to upgrade immediately due to dependency constraints, a temporary workaround involves implementing strict input validation on any Markdown content before it is processed by the application. This includes stripping all HTML tags and attributes from user-supplied text or using a robust library such as Bleach to sanitize inputs prior to rendering. Additionally, deploying Content Security Policy (CSP) headers can help mitigate the impact of successful XSS attacks by restricting the sources from which scripts are allowed to execute, thereby reducing the effectiveness of injected malicious code even if it reaches the client side.