GitHub Advisoryadvisory · PyPI
GHSA-xvg9-69gf-fjrf Material for MkDocs: DOM XSS in search suggestions via query parameter
MEDIUM
Official page ↗
- Aliases
- CVE-2026-73295
- Ecosystem
- PyPI
- Packages
- mkdocs-material
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2026-09-03
Affected packages
• PyPI mkdocs-material: >= 7.2.0, < 9.7.7 → fixed in 9.7.7
Description
Impact
Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional `search.suggest` feature. A crafted `q` URL parameter could execute JavaScript in the documentation site's origin after user interaction.
Patches
The issue is fixed in Material for MkDocs 9.7.7. Users should upgrade to 9.7.7 or later.
Workarounds
Sites unable to upgrade should disable the `search.suggest` feature.
Related
Alias · CVE (1)
- CVE-2026-73295 Material for MkDocs is a powerful documentation framework built on top of MkDocs. vulnerability
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf web
- https://nvd.nist.gov/vuln/detail/CVE-2026-73295 advisory
- https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25 web
- https://github.com/squidfunk/mkdocs-material package
- https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7 web