CVE-2026-73295: DOM-based Cross-Site Scripting (XSS) in Material for MkDocs Search Suggestions
Vulnerability ID: CVE-2026-73295
CVSS Score: 5.4
Published: 2026-09-03
CVE-2026-73295 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Material for MkDocs versions 7.2.0 through 9.7.6. When the optional 'search.suggest' feature is enabled, the client-side 'mountSearchSuggest' function processes user-controlled inputs from the URL 'q' parameter and writes them directly to the DOM using an unsafe innerHTML sink without sanitization.
TL;DR
A DOM-based XSS vulnerability in Material for MkDocs (v7.2.0 to v9.7.6) allows unauthenticated remote attackers to execute arbitrary JavaScript in the victim's browser context via a crafted query parameter when the optional search suggestion feature is enabled.
Technical Details
- CWE ID: CWE-79
- Attack Vector: Network (AV:N)
- CVSS Score: 5.4 (Medium)
- EPSS Score: 0.00185 (0.185%)
- Impact: DOM-based Cross-Site Scripting (XSS)
- Exploit Status: Proof-of-Concept (PoC) available
- KEV Status: Not listed
Affected Systems
- Material for MkDocs with search.suggest feature enabled
-
Material for MkDocs: >= 7.2.0, < 9.7.7 (Fixed in:
9.7.7)
Code Analysis
Commit: 52fb6be
Fix DOM-based XSS vulnerability by replacing innerHTML with textContent and adapting CSS white-space rule.
Mitigation Strategies
- Upgrade Material for MkDocs to version 9.7.7 or later.
- Disable the search.suggest feature in mkdocs.yml if an upgrade is not immediately possible.
Remediation Steps:
- Verify current Material for MkDocs version.
- Update the package using pip install --upgrade mkdocs-material>=9.7.7.
- If immediate upgrade is impossible, open mkdocs.yml, locate 'features' list under 'theme', and comment out '- search.suggest'.
- Rebuild and redeploy the documentation site.
References
Read the full report for CVE-2026-73295 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)