CVE-2026-73295CWE-79cross-site-scripting

CVE-2026-73295

Medium · published August 12, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
24.5
In the wild
Unconfirmed
What it is

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature that allows a crafted q URL parameter to execute JavaScript in a documentation site's origin after user interaction. This issue is fixed in version 9.7.7.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00327 · 24.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-12T21:17Z
References (3)
https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25 · [email protected]https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7 · [email protected]https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf · [email protected]
EPSS history
Timeline
  • 12 AUG 16:15Z
    Material for MkDocs: DOM XSS in search suggestions via query parameter
    cvelistv5