CVE-2026-73295: Material for MkDocs: DOM XSS in search suggestions via query parameter
Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature that allows a crafted q URL parameter to execute JavaScript in a documentation site's origin after user interaction. This issue is fixed in version 9.7.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Material for MkDocsto a version that resolves this vulnerability.Fixed in 9.7.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73295?
The severity of CVE-2026-73295 is medium with a base score of 5.4.
How do I fix CVE-2026-73295?
To fix CVE-2026-73295, upgrade Material for MkDocs to version 9.7.8 or later.
What type of vulnerability is CVE-2026-73295?
CVE-2026-73295 is categorized as a DOM-based cross-site scripting (XSS) vulnerability.
Which versions of Material for MkDocs are affected by CVE-2026-73295?
CVE-2026-73295 affects Material for MkDocs versions from 7.2.0 to 9.7.7.
What component of Material for MkDocs is affected in CVE-2026-73295?
The affected component in CVE-2026-73295 is the mountSearchSuggest function in the search suggest template.