Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active HTML can therefore reach the DOM and execute when another user views the application. This issue is fixed in version 3.2.11.

Affected: PyPI: mercury

## Summary

Mercury turns Jupyter notebooks into shared web apps/dashboards. The `mr.Markdown` widget converts its input to HTML with **python-markdown and no sanitization step**. `MarkdownWidget` is an `ipywidgets.HTML` widget, whose value is written to the page as **raw HTML (via `innerHTML`) with no sanitization**, so the result reaches the DOM verbatim. When an app passes **untrusted data** (database rows, user submissions, uploaded file contents, or an external/LLM API response) to `mr.Markdown`, HTML/JS in that data executes in the browser of **whoever views the app** — a data-driven stored/DOM-based XSS.

This is a library-provided rendering sink that fails to neutralize output; it is triggered by ordinary, reasonable application code, not by an author mistake.

## Root cause

`mercury/md.py` — `MarkdownWidget._to_html()` (verified at v3.2.6, lines ~57–65):

```python def _to_html(self, text: str) -> str: if md_lib is not None: body = md_lib.markdown(text) # python-markdown: passes raw HTML through else: body = f"<pre>{escape(text)}</pre>" # escape() is ONLY the md-lib-absent fallback return self._apply_inline_theme(body) # regex styling — adds style=, removes nothing ```

Two neutralization failures compound:

1. **Markdown → HTML is unsanitized.** `python-markdown` passes raw HTML through by default: `<img src=x onerror=…>`, `<svg onload=…>`, and `javascript:` links survive verbatim. There is no `bleach`/`nh3` allowli…