GHSA-xvg9-69gf-fjrf: XSS
Impact
Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction.
Patches
The issue is fixed in Material for MkDocs 9.7.7. Users should upgrade to 9.7.7 or later.
Workarounds
Sites unable to upgrade should disable the search.suggest feature.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/mkdocs-materialto a version that resolves this vulnerability.Fixed in 9.7.7 - Upgrade
Upgrade
Material for MkDocsto a version that resolves this vulnerability.Fixed in 9.7.7 - Configuration
Disable the optional search.suggest feature on the documentation site if you cannot upgrade past 9.7.6.
Material for MkDocs search.suggest search.suggest (optional feature) = disabled
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using Material for MkDocs versions 7.2.0 through 9.7.6 are affected only when the optional search.suggest feature is enabled. The issue affects the documentation site's own browser origin.
What must an attacker do to exploit it?
An attacker must craft a URL containing a malicious q parameter and cause a user to interact with it. No attacker authentication or special privileges are required.
What should we do if an immediate upgrade is not possible?
Disable the search.suggest feature as a workaround. Upgrade Material for MkDocs to version 9.7.7 or later when possible.