mediumCVSS 5.4Vulnerability
CVE-2026-73295
### Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional `search.suggest` feature. A crafted `q` URL parameter could execute JavaScript in the documentation site's origin after user interaction. ### Patches The issue is fixed in Material for MkDocs 9.7.7. Users should upgrade to 9.7.7 or later. ### Workarounds Sites unable to upgrade should disable the `search.suggest` feature.
Properties
- severity
- medium
- summary
- Material for MkDocs: DOM XSS in search suggestions via query parameter
- epss_score
- 0.00185
- cvss_score
- 5.4
- ghsa_published
- 2026-09-03T19:52:32Z
- source_url
- https://github.com/advisories/GHSA-xvg9-69gf-fjrf
- ghsa_updated
- 2026-09-03T19:52:34Z
- ghsa_id
- GHSA-xvg9-69gf-fjrf
- cve_id
- CVE-2026-73295
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- is_ghsa_only
- false
- epss_percentile
- 0.08097
Related Entities (5)
ENRICHED_BY (1)
→[Source]FIRST EPSS
VULNERABLE_TO (1)
←[Software]pip/mkdocs-material
AFFECTS (1)
→[Software]pip/mkdocs-material
HAS_WEAKNESS (1)
→[Weakness]Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph