{"id":"CVE-2026-73295","aliases":["GHSA-xvg9-69gf-fjrf","PYSEC-2026-3864"],"url":"https://o3.security/vulnerability/CVE-2026-73295","summary":"Material for MkDocs: DOM XSS in search suggestions via query parameter","details":"### Impact\n\nMaterial for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional `search.suggest` feature. A crafted `q` URL parameter could execute JavaScript in the documentation site's origin after user interaction.\n\n### Patches\n\nThe issue is fixed in Material for MkDocs 9.7.7. Users should upgrade to 9.7.7 or later.\n\n### Workarounds\n\nSites unable to upgrade should disable the `search.suggest` feature.","published":"2026-08-12T16:15:22.470Z","modified":"2026-10-20T12:02:20.456741880Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"mkdocs-material","fixedVersion":"9.7.7"}],"fix":{"url":"https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25","label":"squidfunk/mkdocs-material@52fb6be"},"references":[{"type":"WEB","url":"https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73295.json"},{"type":"ADVISORY","url":"https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73295"},{"type":"FIX","url":"https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25"},{"type":"PACKAGE","url":"https://github.com/squidfunk/mkdocs-material"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-20T12:02:20.456741880Z"}}