CVE-2026-73295 in MkDocs Material
Summary
by MITRE • 08/12/2026
Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature that allows a crafted q URL parameter to execute JavaScript in a documentation site's origin after user interaction. This issue is fixed in version 9.7.7.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/12/2026
The Material for MkDocs framework represents a widely adopted documentation solution that leverages MkDocs as its foundation, offering enhanced styling and functionality for technical documentation websites. This vulnerability specifically targets the search.suggest feature introduced in version 7.2.0 and persisting through 9.7.7, creating a significant security risk for documentation sites utilizing this functionality. The flaw exists within the mountSearchSuggest function located in src/templates/assets/javascripts/components/search/suggest/index.ts, which processes user input through URL parameters without adequate sanitization or validation mechanisms.
The technical implementation of this vulnerability stems from improper handling of the q URL parameter that is passed to the search.suggest feature. When users interact with the search interface, the JavaScript code fails to properly escape or sanitize user-provided input before incorporating it into the DOM structure. This creates an environment where malicious actors can inject crafted JavaScript payloads through the search query parameter, which then executes in the context of the documentation site's origin when users engage with the search suggestions. The vulnerability is classified as a DOM-based cross-site scripting flaw that aligns with CWE-79 (Cross-site Scripting) and specifically maps to CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) within the CWE taxonomy.
The operational impact of this vulnerability extends beyond typical web application security concerns, as it affects documentation sites that may contain sensitive information or serve as primary knowledge repositories for organizations. Attackers exploiting this vulnerability can execute arbitrary JavaScript code in the context of legitimate user sessions, potentially leading to session hijacking, data exfiltration, or the delivery of additional malicious payloads. The requirement for user interaction makes this vector particularly concerning as it can be exploited through social engineering tactics where users are directed to malicious search queries that appear legitimate within the documentation context.
Security mitigations for this vulnerability involve upgrading to version 9.7.7 or later, which implements proper input sanitization and output encoding mechanisms for the search.suggest functionality. Organizations should also consider implementing Content Security Policy headers with strict directives to limit script execution capabilities, though this serves as a secondary defense mechanism rather than a complete solution. The vulnerability demonstrates the importance of validating and sanitizing all user inputs, particularly in features that dynamically process and display external data within web applications. This issue aligns with ATT&CK technique T1213.002 (Data from Information Repositories) and represents a critical security gap that highlights the need for comprehensive input validation across all web application components, especially those handling user-generated content or search functionality.