MEDIUM5.4

GHSA-xvg9-69gf-fjrf

Material for MkDocs: DOM XSS in search suggestions via query parameter

Quick fix

GHSA-xvg9-69gf-fjrf — mkdocs-material: upgrade to the fixed version with the command below.

pip install --upgrade 'mkdocs-material>=9.7.7'

Details

### Impact

Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional `search.suggest` feature. A crafted `q` URL parameter could execute JavaScript in the documentation site's origin after user interaction.

### Patches

The issue is fixed in Material for MkDocs 9.7.7. Users should upgrade to 9.7.7 or later.

### Workarounds

Sites unable to upgrade should disable the `search.suggest` feature.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/mkdocs-material

Introduced in: 7.2.0Fixed in: 9.7.7

Fixpip install --upgrade 'mkdocs-material>=9.7.7'

References

https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-73295[ADVISORY]
https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25[WEB]
https://github.com/squidfunk/mkdocs-material[PACKAGE]
https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7[WEB]