mercury vulnerabilities
CVEs whose affected-version data names the mercury package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-111059Medium· 6.1Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
▾ Sunlitmercury · mercuryvia GHSA
CVE-2026-111058Critical· 9.8Mercury: Unauthenticated Remote Code Execution via /api/kernels
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing …
▾ Midnightmljar · mercuryvia CVEORG
CVE-2026-111057Critical· 10.0Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
▾ Midnightmercury · mercuryvia GHSA