Skip to content
OpenAdvisories

Package · PyPI

mercury

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Medium 6.1
    CVE-2026-111059

    Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML

    Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Even…

    mljar mercury mercury PyPI
  • Critical 9.8
    CVE-2026-111058 Public exploit

    Mercury: Unauthenticated Remote Code Execution via /api/kernels

    Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The …

    mljar mercury mercury PyPI
  • Critical 10.0
    CVE-2026-111057

    Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

    Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals theref…

    mljar mercury mercury PyPI