{"id":"CVE-2026-73295","aliases":["GHSA-xvg9-69gf-fjrf"],"url":"https://o3.security/vulnerability/CVE-2026-73295","summary":"Material for MkDocs: DOM XSS in search suggestions via query parameter","details":"Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature that allows a crafted q URL parameter to execute JavaScript in a documentation site's origin after user interaction. This issue is fixed in version 9.7.7.","published":"2026-08-12T16:15:22.470Z","modified":"2026-08-15T11:31:03.095075038Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"mkdocs-material","fixedVersion":"9.7.7"}],"fix":{"url":"https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25","label":"squidfunk/mkdocs-material@52fb6be"},"references":[{"type":"WEB","url":"https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73295.json"},{"type":"ADVISORY","url":"https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73295"},{"type":"FIX","url":"https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-15T11:31:03.095075038Z"}}