CVE-2026-73295: Material for MkDocs DOM XSS in search suggestions

Executive brief

Material for MkDocs is a popular theme used to build technical documentation sites. Versions 7.2.0 through 9.7.6 contain a DOM-based cross-site scripting (XSS) vulnerability in the optional search suggestions feature. An attacker could craft a malicious URL with a specially crafted search query parameter that, when clicked by a user, executes arbitrary JavaScript in the victim's browser within the documentation site's origin, potentially stealing session data, authentication tokens, or sensitive content visible to the user.

Technical details

This is a DOM-based XSS vulnerability (CWE-79) in Material for MkDocs' search.suggest feature. The vulnerability exists in the handling of the URL query parameter 'q' used for search suggestions. The root cause is improper sanitization of user-controllable input before it is placed into the DOM. Attack requires user interaction—specifically, a user must click on a link with a malicious q parameter value. No authentication or special privileges are required. An attacker can achieve arbitrary JavaScript execution in the context of the affected documentation site, potentially allowing session hijacking, credential theft, or defacement. The vulnerability is network-reachable and affects versions 7.2.0 through 9.7.6. A patch is available in version 9.7.7 and later. Organizations unable to upgrade can disable the search.suggest feature as a workaround.

Affected products

• squidfunk Material for MkDocs 7.2.0 through 9.7.6

Timeline

• 2026-07-17: disclosed: Vulnerability disclosed on GitHub Advisory Database
• 2026-09-03: patched: Fixed in Material for MkDocs version 9.7.7

References

• https://api.github.com/users/p-
• https://github.com/p-
• https://api.github.com/users/p-/gists%7B/gist_id%7D
• https://api.github.com/users/p-/repos
• https://avatars.githubusercontent.com/u/176818?v=4
• https://api.github.com/users/p-/events%7B/privacy%7D