Read the docs
TI-2026-76431 Aliases CVE-2026-111059GHSA-2658-85cv-9wwq

Mercury mr.Markdown renders untrusted Markdown as unsanitized HTML (XSS)

Priority LOW 27CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Mercury, a Python framework for sharing Jupyter notebooks as web applications and dashboards, is affected from 3.0.0 before 3.2.11. mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active HTML can reach the DOM and run when another user views the application. The CVSS 3.1 base score is 6.1 (MEDIUM), mapped to CWE-79 and CWE-116.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active HTML can therefore reach the DOM and execute when another user views the application. This issue is fixed in version 3.2.11.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00284 21st percentileScored 2026-11-07
Fix Fixed mercury (mljar): 3.2.11mercury (PyPI): 3.2.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mljarmercury3.0.0 to before 3.2.113.2.11Patch availableCNA
—mercury (PyPI)3.0.0 to before 3.2.113.2.11Patch availableGHSA-2658-85cv-9wwq
  • mercury Vendormljar Affected 3.0.0 to before 3.2.11 Fixed in 3.2.11 Patch available CNA
  • mercury (PyPI) Vendor— Affected 3.0.0 to before 3.2.11 Fixed in 3.2.11 Patch available GHSA-2658-85cv-9wwq

Remediation

Upgrade Mercury to 3.2.11, the version that fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA mercury (mljar) Fixed in 3.2.11
  • Fix · GHSA-2658-85cv-9wwq mercury (PyPI) Fixed in 3.2.11 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-111059
  2. 2026-10-20 Alias added: GHSA-2658-85cv-9wwq
  3. 2026-10-20 Fix available: PyPI/[email protected] · GHSA-2658-85cv-9wwq
  4. 2026-10-20 CVSS score added · GHSA-2658-85cv-9wwq
  5. 2026-10-20 Weakness changed · GHSA-2658-85cv-9wwq
  6. 2026-10-20 4 new references · GHSA-2658-85cv-9wwq
  7. 2026-10-20 CISA SSVC decision points changed
  8. 2026-10-20 Priority changed: MEDIUM → LOW
  9. 2026-11-06 Affected versions changed · Red Hat
  10. 2026-11-06 CVSS score added · Red Hat

References

Other 4

  • TI-2026-76429 Mercury: unauthenticated remote code execution via /api/terminals bypass CVSS 3.1CRITICAL 10.0
  • TI-2025-01287 Remote Code Execution in PlotAI CVSS 4.0CRITICAL 9.3
  • TI-2026-76430 Mercury lets anonymous clients execute arbitrary Python code CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences