PT-2026-71146 · Unknown · Material For Mkdocs

CVE-2026-73295

·

Published

2026-08-12

·

Updated

2026-09-10

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Material for MkDocs versions 7.2.0 through 9.7.6
Description The optional search.suggest feature contains a DOM-based cross-site scripting issue. This occurs within the mountSearchSuggest() function in src/templates/assets/javascripts/components/search/suggest/index.ts, where a crafted q URL parameter can be used to execute JavaScript in the origin of a documentation site following user interaction.
Recommendations Update to version 9.7.7. As a temporary mitigation, disable the search.suggest feature.

Exploit

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-73295
GHSA-XVG9-69GF-FJRF
PYSEC-2026-3864

Affected Products

Material For Mkdocs