mercury
PyPI3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting mercurypage 1 of 1
- CVE-2026-111057CRITICALCVSS 10.0EG 10.0fixed in 3.2.42026-10-19
vulnerable: 3.0.0 ... 3.2.3 (12 versions)
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /…
- CVE-2026-111058CRITICALCVSS 9.8EG 9.8fixed in 3.2.62026-10-19
vulnerable: 1.1.6 ... 3.2.5 (93 versions)
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing ar…
- CVE-2026-111059MEDIUMCVSS 6.1EG 6.1fixed in 3.2.112026-10-19
vulnerable: 3.0.0 ... 3.2.9 (19 versions)
Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywid…
Check whether mercury is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for mercury CVEs against the assets you own.
Book a Demo →