GHSA-xvg9-69gf-fjrf

Material for MkDocs: DOM XSS in search suggestions via query parameter

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-73295

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	mkdocs-material	>= 7.2.0, < 9.7.7	9.7.7

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional `search.suggest` feature. A crafted `q` URL parameter could execute JavaScript in the documentation site's origin after user interaction. ### Patches The issue is fixed in Material for MkDocs 9.7.7. Users should upgrade to 9.7.7 or later. ### Workarounds Sites unable to upgrade should disable the `search.suggest` feature.

References

External links from the advisory. They lead to third-party sites.

https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf web
https://nvd.nist.gov/vuln/detail/CVE-2026-73295 advisory
https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25 web
https://github.com/squidfunk/mkdocs-material package
https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7 web