# CVE-2026-111059: MLJAR Mercury stored cross-site scripting in Markdown

Source: https://junglewise.ai/threats/cve-2026-111059-mercury-is-a-python-framework-for-sharing-jupyter-notebooks-as  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-111059 · Severity: medium · CVSS 6.1 · Published 2026-10-19

Mercury is a Python framework that converts Jupyter notebooks into web applications and dashboards. From version 3.0.0 through 3.2.10, the mr.Markdown component failed to sanitize user-supplied HTML content before rendering it in the browser, allowing attackers to inject malicious scripts and event handlers that execute when other users view the application.

Technologies: [Mljar Mercury](https://junglewise.ai/threats/technologies/mercury), [mercury (PyPI)](https://junglewise.ai/threats/technologies/pypi-mercury). Vendors: [Mljar](https://junglewise.ai/threats/vendors/mljar), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-111059 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111059 being exploited in the wild.

**How severe is CVE-2026-111059?** Medium severity, with a CVSS score of 6.1, published 19 October 2026.

**Which products and versions are affected?** Mljar Mercury 3.0.0 through 3.2.10; mercury (PyPI) >= 3.0.0, < 3.2.11, ECOSYSTEM:introduced=3.0.0,fixed=3.2.11.

**Is there a fix for CVE-2026-111059?** Yes. mercury (PyPI): upgrade to 3.2.11 or later. Until then: For trusted applications that require raw HTML rendering, the fix in 3.2.11 introduces an unsafe_allow_html=True parameter for mr.Message that preserves the original Jupyter renderer behavior. Keep this parameter disabled for all user-supplied or untrusted content and AI-generated responses.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-19"},{"kind":"patched","at":"2026-09-10","note":"Fix committed; version 3.2.11 released 2026-09-10"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111059 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-111059?** Check whether you run Mljar Mercury or mercury (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mercury (PyPI): upgrade to 3.2.11 or later

  ```sh
  pip install "mercury>=3.2.11"
  ```


For trusted applications that require raw HTML rendering, the fix in 3.2.11 introduces an unsafe_allow_html=True parameter for mr.Message that preserves the original Jupyter renderer behavior. Keep this parameter disabled for all user-supplied or untrusted content and AI-generated responses.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-19"},{"kind":"patched","at":"2026-09-10","note":"Fix committed; version 3.2.11 released 2026-09-10"}]

## Technical details

The mr.Markdown converter processes attacker-controlled Markdown input and converts it to HTML without sanitizing raw HTML tags, event-handler attributes, and other active content before passing it to ipywidgets.HTML. An attacker can inject JavaScript via HTML event handlers (e.g., onload, onclick) or script tags that execute in the DOM when another user views the application. This is a stored XSS vulnerability affecting versions 3.0.0 through 3.2.10, fixed in 3.2.11 by implementing HTML and Markdown sanitization by default.

## Affected products

- MLJAR Mercury 3.0.0 through 3.2.10

## Identifiers

- CVE-2026-111059
- GHSA-2658-85cv-9wwq

## References

- [https://github.com/mljar/mercury/commit/c798a85924e6614c6fea7afe5a560e4554a1d09b](https://github.com/mljar/mercury/commit/c798a85924e6614c6fea7afe5a560e4554a1d09b)
- [https://github.com/mljar/mercury/releases/tag/v3.2.11](https://github.com/mljar/mercury/releases/tag/v3.2.11)

## Related threats

- [Mercury framework arbitrary code execution in anonymous kernels](https://junglewise.ai/threats/cve-2026-111058-mercury-is-a-python-framework-for-sharing-jupyter-notebooks-as)
- [Mercury Python framework regex bypass in terminal API access](https://junglewise.ai/threats/cve-2026-111057-mercury-is-a-python-framework-for-sharing-jupyter-notebooks-as)