CVE-2026-73295 Material for MkDocs: DOM XSS in search suggestions via query parameter
An attacker can execute arbitrary JavaScript in a documentation site's origin via a crafted URL parameter in the optional search suggestion feature.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-73295?
CVE-2026-73295 is a medium-severity cross-site scripting vulnerability in squidfunk mkdocs-material, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature that allows a crafted q URL parameter to execute JavaScript in a documentation site's origin after user interaction. This issue is fixed in version 9.7.7.
Weakness: CWE-79
Which versions are affected by CVE-2026-73295?
3 open source packages ship an affected version, including mkdocs-material.
| Package | Affected | Fixed in |
|---|---|---|
mkdocs-material PyPI | From 7.2.0 | 9.7.7 |
mkdocs-material PyPI | From 7.2.0 | 9.7.7 |
mkdocs-material PyPI | From 7.2.0 | 9.7.7 |
How do I fix CVE-2026-73295?
Upgrade mkdocs-material to 9.7.7 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-73295 being exploited?
There is no known exploitation of CVE-2026-73295 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-73295, GHSA-xvg9-69gf-fjrf, PYSEC-2026-3864, UBUNTU-CVE-2026-73295.