{"data":{"id":"141e2e0c-a36b-4645-aaf7-0b30ae1ba552","title":"GHSA-2658-85cv-9wwq: Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML","summary":"Mercury's mr.Markdown widget converts input with python-markdown and no sanitization, and MarkdownWidget writes the result to the DOM via innerHTML without sanitization. When an app passes untrusted data to mr.Markdown, HTML or JavaScript in that data executes in the browser of whoever views the app, a stored or DOM-based XSS.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-2658-85cv-9wwq","publishedAt":"2026-10-19T17:01:20.000Z","cveId":"CVE-2026-111059","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mercury@>= 3.0.0, < 3.2.11 (fixed: 3.2.11)"],"affectedPackageNames":["mercury"],"affectedPackageRefs":["pypi:mercury"],"affectedVendors":[],"affectedVendorsRaw":["Mercury","Jupyter","ipywidgets","python-markdown"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-19T18:08:32.943Z","kevDateAdded":null,"advisoryAliases":["GHSA-2658-85cv-9wwq"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-10-19T17:01:20.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null}}