GHSL-2026-151: Crafted search links can execute JavaScript on mkdocs-material sites - CVE-2026-73295

Published Oct 22, 2026

Updated

mkdocs-material's search suggestion allowed crafted links to execute JavaScript in the origin of documentation sites that enable the feature.

Affected Software

1 affected component

pypi/mkdocs-material

Event History

Oct 22, 2026

Advisory Published

via GitHub Security Lab·12:00 AM

Data Sourced

via GitHub Security Lab·12:00 AM

Description

Frequently Asked Questions

Which deployments are exposed?

Documentation sites using mkdocs-material are affected when they enable the search suggestion feature. The issue executes in the origin of the affected documentation site.

What does an attacker need to exploit this issue?

An attacker needs to craft a search link that is processed by the search suggestion feature. The provided information does not state any additional authentication or interaction requirements.

GHSL-2026-151: Crafted search links can execute JavaScript on mkdocs-material sites - CVE-2026-73295

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?