CVE-2026-73295: Material for MkDocs: DOM XSS in search suggestions via query parameter

September 3, 2026

Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site’s origin after user interaction.

References

github.com/advisories/GHSA-xvg9-69gf-fjrf
github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25
github.com/squidfunk/mkdocs-material/releases/tag/9.7.7
github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf
nvd.nist.gov/vuln/detail/CVE-2026-73295

Code Behaviors & Features

Detect and mitigate CVE-2026-73295 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →