{
"id": "GHSA-xvg9-69gf-fjrf",
"aliases": [
"CVE-2026-73295"
],
"details": "### Impact\n\nMaterial for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional `search.suggest` feature. A crafted `q` URL parameter could execute JavaScript in the documentation site's origin after user interaction.\n\n### Patches\n\nThe issue is fixed in Material for MkDocs 9.7.7. Users should upgrade to 9.7.7 or later.\n\n### Workarounds\n\nSites unable to upgrade should disable the `search.suggest` feature.",
"summary": "Material for MkDocs: DOM XSS in search suggestions via query parameter",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.2.0"
},
{
"fixed": "9.7.7"
}
]
}
],
"package": {
"name": "mkdocs-material",
"ecosystem": "PyPI"
}
}
],
"modified": "2026-09-03T19:52:32Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
}
],
"published": "2026-09-03T19:52:32Z",
"references": [
{
"url": "https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf",
"type": "WEB"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73295",
"type": "ADVISORY"
},
{
"url": "https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25",
"type": "WEB"
},
{
"url": "https://github.com/squidfunk/mkdocs-material",
"type": "PACKAGE"
},
{
"url": "https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2026-08-12T17:17:32Z",
"github_reviewed_at": "2026-09-03T19:52:32Z"
}
}