AI Threat AlertMercury, a Python framework that turns Jupyter notebooks into shared web apps and dashboards, has a cross-site scripting flaw (CVE-2026-111059) in versions 3.0.0 to 3.2.10. Its mr.Markdown component passes attacker-controlled Markdown to an HTML widget without sanitizing it, so event-handler attributes and other active HTML run in the browser of anyone who views the app. Severity is medium (CVSS 6.1). EPSS is low at 0.00284 (top 80th percentile), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. The package has 3,043 dependents and an OpenSSF Scorecard of 5.8/10, and 72 other CVEs have been reported against it. Upgrade to Mercury 3.2.11 and prioritize any deployment where untrusted users can supply Markdown content or where dashboards are shared with privileged staff.
What is the risk?
Medium overall. The attack is network-reachable, low complexity and needs no privileges, but a victim must view the poisoned content (CVSS UI:R). The scope is changed (S:C), so script runs in the victim's browser session. Real risk depends on whether the Markdown can be influenced by untrusted parties, for example through user input, shared notebooks or external data feeds. Exploitation likelihood is low per EPSS, with no public exploit and no KEV listing. Internal-only dashboards that only trusted authors write to carry much lower exposure.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Jupyter Notebook | pip | >= 3.0.0, < 3.2.11 | 3.2.11 |
Do you use Jupyter Notebook? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade mercury to 3.2.11 or later (pip install -U mercury). 2) Until patched, avoid passing untrusted or user-supplied content to mr.Markdown and restrict who can author or edit notebooks. 3) Put a strict Content-Security-Policy (no inline scripts, no inline event handlers) in front of Mercury deployments. 4) Place dashboards behind authentication and limit sharing to trusted users. 5) Review notebooks and stored content for raw HTML such as <script>, onerror= or onload= attributes. 6) Inventory Mercury versions via SBOM or pip freeze and track GHSA-2658-85cv-9wwq.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-111059?
Mercury, a Python framework that turns Jupyter notebooks into shared web apps and dashboards, has a cross-site scripting flaw (CVE-2026-111059) in versions 3.0.0 to 3.2.10. Its mr.Markdown component passes attacker-controlled Markdown to an HTML widget without sanitizing it, so event-handler attributes and other active HTML run in the browser of anyone who views the app. Severity is medium (CVSS 6.1). EPSS is low at 0.00284 (top 80th percentile), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. The package has 3,043 dependents and an OpenSSF Scorecard of 5.8/10, and 72 other CVEs have been reported against it. Upgrade to Mercury 3.2.11 and prioritize any deployment where untrusted users can supply Markdown content or where dashboards are shared with privileged staff.
Is CVE-2026-111059 actively exploited?
No confirmed active exploitation of CVE-2026-111059 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-111059?
1) Upgrade mercury to 3.2.11 or later (pip install -U mercury). 2) Until patched, avoid passing untrusted or user-supplied content to mr.Markdown and restrict who can author or edit notebooks. 3) Put a strict Content-Security-Policy (no inline scripts, no inline event handlers) in front of Mercury deployments. 4) Place dashboards behind authentication and limit sharing to trusted users. 5) Review notebooks and stored content for raw HTML such as <script>, onerror= or onload= attributes. 6) Inventory Mercury versions via SBOM or pip freeze and track GHSA-2658-85cv-9wwq.
What systems are affected by CVE-2026-111059?
This vulnerability affects the following AI/ML architecture patterns: Notebook-to-web-app dashboards, ML experiment reporting portals, Internal data science tooling.
What is the CVSS score for CVE-2026-111059?
CVE-2026-111059 has a CVSS v3.1 base score of 6.1 (MEDIUM). The EPSS exploitation probability is 0.28%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0049Exploit Public-Facing ApplicationAML.T0078Drive-by CompromiseCompliance Controls Affected
What are the technical details?
Original Advisory
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active HTML can therefore reach the DOM and execute when another user views the application. This issue is fixed in version 3.2.11.
Exploitation Scenario
An attacker who can influence Markdown rendered by a shared Mercury dashboard, for example through a user-input field, a notebook they are allowed to edit, or an upstream data source, embeds an HTML tag with an event handler such as an img onerror attribute. When an analyst or data scientist opens the app, the payload runs in their browser. It steals the session cookie or token, calls Mercury or neighboring internal endpoints as the victim, or shows a fake login prompt to harvest credentials.
Weaknesses (CWE)
CWE-116Improper Encoding or Escaping of OutputPrimaryCWE-116Improper Encoding or Escaping of OutputPrimaryCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')PrimaryCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')PrimaryCWE-116Improper Encoding or Escaping of OutputCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-116 — Improper Encoding or Escaping of Output: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error. Alternately, use built-in functions, but consider using wrappers in case those functions are discovered to have a vulnerability.
- [Architecture and Design] If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated. For example, stored procedures can enforce database query structure and reduce the likelihood of SQL injection.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-7281110.0SiYuan: SQL injection enables cross-notebook DB access
Same package: notebookCVE-2026-6908510.0SiYuan: SQL injection in searchDocs allows DB tampering
Same package: notebookCVE-2026-6908410.0SiYuan: SQL injection in search endpoint exposes notebooks
Same package: notebookCVE-2026-6908310.0SiYuan: unauthenticated SQLi in full-text search endpoint
Same package: notebookCVE-2026-11105710.0Mercury: regex blocklist bypass allows unauthenticated RCE
Same package: notebook