CVE-2026-73295: Material for MkDocs XSS Vulnerability

CVE-2026-73295 Overview

CVE-2026-73295 is a DOM-based cross-site scripting (XSS) vulnerability [CWE-79] in Material for MkDocs, a documentation framework built on top of MkDocs. The flaw resides in the mountSearchSuggest function within src/templates/assets/javascripts/components/search/suggest/index.ts. Affected versions range from 7.2.0 up to but not including 9.7.7. When the optional search.suggest feature is enabled, a crafted q URL parameter can execute attacker-controlled JavaScript in the documentation site's origin after user interaction. The maintainer released a fix in version 9.7.7.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of the documentation site, enabling session theft, credential harvesting, and content tampering after a single user interaction.

Affected Products

Material for MkDocs versions 7.2.0 through 9.7.6
Documentation sites with the optional search.suggest feature enabled
Deployments serving the vulnerable mountSearchSuggest component to end users

Discovery Timeline

2026-08-12 - CVE-2026-73295 published to NVD
2026-08-12 - Last updated in NVD database
Version 9.7.7 - Fix released via GitHub Release Version 9.7.7 and documented in GHSA-xvg9-69gf-fjrf

Technical Details for CVE-2026-73295

Vulnerability Analysis

The vulnerability is a client-side DOM-based XSS in the search suggestion component. Material for MkDocs reads the q query string parameter from the URL and uses it to render inline search suggestions. The vulnerable code path assigned attacker-controlled string content to element.innerHTML, which causes the browser to parse the value as HTML. Any tags or event handlers embedded in q are inserted into the live DOM. Because rendering occurs in the browser after the page loads, standard server-side sanitization does not apply. Exploitation is confined to the origin of the documentation site but can compromise authenticated sessions, private documentation portals, and any cookies scoped to that domain.

Root Cause

The root cause is the use of innerHTML to display user-supplied text without escaping. The mountSearchSuggest subscriber joined word tokens and assigned the resulting string to el.innerHTML, allowing HTML parsing of untrusted input from the q parameter. The upstream fix replaces this assignment with el.textContent, which treats the value as literal text and blocks HTML interpretation.

Attack Vector

An attacker crafts a URL pointing at a vulnerable documentation site with a malicious q parameter containing an HTML payload. The victim clicks the link or is redirected through a referrer. When the search suggestion component mounts and processes the value, the injected markup renders in the DOM and its JavaScript executes. User interaction is required, which is consistent with the search-triggered nature of the sink.

typescript

// Patch: src/templates/assets/javascripts/components/search/suggest/index.ts
// Source: https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25
         return words
       })
     )
-      .subscribe(words => el.innerHTML = words
-        .join("")
-        .replace(/\s/g, " ")
-      )
+      .subscribe(words => el.textContent = words.join(""))
 
   /* Set up search keyboard handlers */
   keyboard$

The fix removes the HTML sink by switching from innerHTML to textContent, ensuring the joined words are inserted as text nodes rather than parsed as markup.

Detection Methods for CVE-2026-73295

Indicators of Compromise

Inbound requests to documentation site URLs containing suspicious q parameter values with HTML tags, <script>, <img>, <svg>, or on*= event handler substrings
Referrer logs showing external sites linking to internal docs with encoded payloads in the q parameter
Browser console errors or Content Security Policy (CSP) violation reports originating from the search suggestion component

Detection Strategies

Inventory MkDocs deployments and confirm the installed version of mkdocs-material; flag any instance running 7.2.0 through 9.7.6 with search.suggest enabled in mkdocs.yml
Deploy a strict CSP with script-src restrictions and enable report-uri or report-to endpoints to surface injection attempts against the documentation origin
Add web application firewall (WAF) rules that inspect the q query parameter for HTML metacharacters and known XSS signatures

Monitoring Recommendations

Aggregate web server access logs and hunt for anomalous q parameter lengths, URL-encoded angle brackets (%3C, %3E), and JavaScript scheme references
Monitor authentication and session activity on any documentation site that requires login, particularly unexpected token reuse from new user agents
Track outbound requests from user browsers viewing documentation pages to detect data exfiltration triggered by injected scripts

How to Mitigate CVE-2026-73295

Immediate Actions Required

Upgrade mkdocs-material to version 9.7.7 or later and rebuild all documentation sites
If immediate upgrade is not possible, disable the search.suggest feature in mkdocs.yml to remove the vulnerable code path
Invalidate CDN and browser caches so users receive the patched JavaScript assets

Patch Information

The fix is available in Material for MkDocs 9.7.7. The relevant commit 52fb6be8aafe326419f34dc94d3211e7bbfbfb25 replaces the innerHTML sink in mountSearchSuggest with textContent. See the GitHub Security Advisory GHSA-xvg9-69gf-fjrf and the GitHub Commit Update for full details.

Workarounds

Disable the search suggestion feature by removing suggest from the search plugin configuration in mkdocs.yml
Enforce a strict Content Security Policy that forbids inline scripts and restricts script-src to trusted origins
Add WAF or reverse proxy rules to strip or reject requests whose q parameter contains HTML tags or event handler attributes

bash

# Configuration example - disable vulnerable feature until patched
# mkdocs.yml
plugins:
  - search:
      # Remove or comment out the suggest option
      # suggest: true

# Then upgrade to the patched release
pip install --upgrade "mkdocs-material>=9.7.7"
mkdocs build --clean