Approved changes feed: RSS · Atom
cpe:2.3:a:mljar:mercury:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Mljar (d0b47c1f-166e-5f31-bf9c-0e59c0fe1997) |
|---|---|
| Product | Mercury (2664ce7b-4108-52ed-b286-ebd5bdca27f3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-111058 |
vulnerable | 2026-11-03 10:16:11.514564 |
Mercury: Unauthenticated Remote Code Execution via /api/kernels
CRITICAL (9.8)
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6.
Published: 2026-10-19T16:06:22.646Z
Updated: 2026-10-19T17:06:53.899Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-111059 |
vulnerable | 2026-11-03 10:16:11.037858 |
Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
MEDIUM (6.1)
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active HTML can therefore reach the DOM and execute when another user views the application. This issue is fixed in version 3.2.11.
Published: 2026-10-19T16:11:29.745Z
Updated: 2026-10-20T16:11:40.067Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-111057 |
vulnerable | 2026-11-03 10:16:10.979583 |
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
CRITICAL (10)
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4.
Published: 2026-10-19T16:04:07.065Z
Updated: 2026-10-28T15:31:24.524Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.