{"id":"ghsa-ghsa-2658-85cv-9wwq","seq":2441,"kind":"advisory","title":"Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML","url":"https://github.com/advisories/GHSA-2658-85cv-9wwq","permalink":"https://vulnpulse.app/items/ghsa-ghsa-2658-85cv-9wwq","summary":"影響: pip:mercury >= 3.0.0, < 3.2.11 → 3.2.11\nSummary Mercury turns Jupyter notebooks into shared web apps/dashboards. The mr.Markdown widget converts its input to HTML with python-markdown and no sanitization step. MarkdownWidget is an ipywidgets.HTML widget, whose value is written to the page as raw HTML (via innerHTML) with no sanitization, so the result reaches the DOM verbatim. When an app passes untrusted data (database rows, user submissions, uploaded file contents, or an external/LLM API response) to mr.Markdown, HTML/JS in that da…","severity":"medium","techs":["python"],"cves":["CVE-2026-111059"],"tags":["GHSA-2658-85cv-9wwq","mercury"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-19T17:01:20.000Z","fetched_at":"2026-10-21T16:17:46.637Z"}