THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-xvg9-69gf-fjrf (medium) — Material for MkDocs: DOM XSS in search suggestions via query parameter

[GHSA] GHSA-xvg9-69gf-fjrf (medium) — Material for MkDocs: DOM XSS in search suggestions via query parameter

medgithub_advisoriesPublished 2026-09-03

GHSA-xvg9-69gf-fjrf Severity: medium CVE: CVE-2026-73295

Material for MkDocs: DOM XSS in search suggestions via query parameter

### Impact

Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional `search.suggest` feature. A crafted `q` URL parameter could execute JavaScript in the documentation site's origin after user interaction.

### Pat

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-73295cve

Original source: https://github.com/advisories/GHSA-xvg9-69gf-fjrf