Mercury is a Python framework for sharing Jupyter notebooks as web applications. From version 3.0.0 through 3.2.11, the mr.Markdown widget converts user‑supplied Markdown into HTML without sanitizing embedded HTML before assigning it to an ipywidgets.HTML sink. As a result, attacker‑controlled HTML, including event‑handler attributes and other ActiveContent, can reach the browser DOM and execute when a second user views the application. The vulnerability is a stored DOM‑based cross‑site scripting (XSS) flaw, allowing an attacker to run arbitrary JavaScript in the victim’s browser and potentially steal session cookies, deface content, or perform phishing attacks. The weakness is a CWE‑79 Cross‑Site Scripting issue, combined with CWE‑116 unsafe buffer handling in the conversion process.

The affected product is Mercury from the vendor mljar, with all releases from version 3.0.0 up to and including 3.2.11 vulnerable. The vendor fix is introduced in Mercury 3.2.11.

The CVSS score is 6.1, indicating moderate severity for a stored XSS. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so no known exploits have been reported yet. Because the flaw requires only that an attacker be able to embed malicious Markdown into a notebook that is then shared, the attack can be carried out by a user with editing privileges on shared notebooks or dashboards. The primary vector is via the browser rendering of untrusted Markdown, allowing JavaScript execution, and no elevated privileges are needed.