Arbitrary HTML Injection in Mercury Framework by MLJAR
CVE-2026-111059
6.1MEDIUM
What is CVE-2026-111059?
The Mercury framework, utilized for sharing Jupyter notebooks as web applications and dashboards, contains a vulnerability from versions 3.0.0 to 3.2.11. The issue arises in the mr.Markdown component, which fails to properly sanitize attacker-controlled Markdown before converting it to HTML. This lack of sanitation allows active HTML, including event-handler attributes, to be introduced into the Document Object Model (DOM). Consequently, when another user views the affected application, harmful scripts can be executed, compromising user security. This vulnerability has been rectified in version 3.2.11.
Affected Version(s)
mercury >= 3.0.0, < 3.2.11