{"id":"CVE-2026-73295","title":"Material for MkDocs is a powerful documentation framework built on top of MkDocs","summary":"Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-s…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"mkdocs-material","product":"mkdocs-material","affected":["mkdocs-material >= 7.2.0, < 9.7.7"],"patched":["mkdocs-material 9.7.7"],"published":"2026-08-12","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:02:22.660","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-73295","references":[{"url":"https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25","label":"security-advisories@github.com"},{"url":"https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7","label":"security-advisories@github.com"},{"url":"https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73295"},{"url":"https://github.com/advisories/GHSA-xvg9-69gf-fjrf"},{"url":"https://github.com/squidfunk/mkdocs-material"},{"url":"https://pypi.org/project/mkdocs-material"}],"tags":["nvd","ghsa","pip","osv"],"epss":0.00327,"epssPercentile":0.2563,"aliases":["GHSA-xvg9-69gf-fjrf","PYSEC-2026-3864"],"ecosystem":"pip","ingestedAt":"2026-09-03T20:08:06.541Z","slug":"CVE-2026-73295","body":"## Overview\n\nMaterial for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature that allows a crafted q URL parameter to execute JavaScript in a documentation site's origin after user interaction. This issue is fixed in version 9.7.7.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-73295)\n\nAffected packages:\n\n- `mkdocs-material >= 7.2.0, < 9.7.7`\n\nPatched in:\n\n- `mkdocs-material 9.7.7`\n\nSource: https://github.com/advisories/GHSA-xvg9-69gf-fjrf","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}