https://vulnerability.circl.lu/sightings/feed 2026-09-13T18:22:27.378415+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/932572e2-c120-415b-a17a-ad97d6b7fa9b/export 2026-09-13T18:22:27.402033+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "932572e2-c120-415b-a17a-ad97d6b7fa9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73295", "type": "seen", "source": "https://gist.github.com/alon710/b48a4802ab7de78f3b7bc06aac45d10c", "content": "# CVE-2026-73295: CVE-2026-73295: DOM-based Cross-Site Scripting (XSS) in Material for MkDocs Search Suggestions\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73295\n\n## Summary\nCVE-2026-73295 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Material for MkDocs versions 7.2.0 through 9.7.6. When the optional 'search.suggest' feature is enabled, the client-side 'mountSearchSuggest' function processes user-controlled inputs from the URL 'q' parameter and writes them directly to the DOM using an unsafe innerHTML sink without sanitization.\n\n## TL;DR\nA DOM-based XSS vulnerability in Material for MkDocs (v7.2.0 to v9.7.6) allows unauthenticated remote attackers to execute arbitrary JavaScript in the victim's browser context via a crafted query parameter when the optional search suggestion feature is enabled.\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.4 (Medium)\n- **EPSS Score**: 0.00185 (0.185%)\n- **Impact**: DOM-based Cross-Site Scripting (XSS)\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Material for MkDocs with search.suggest feature enabled\n- **Material for MkDocs**: >= 7.2.0, < 9.7.7 (Fixed in: `9.7.7`)\n\n## Mitigation\n\n- Upgrade Material for MkDocs to version 9.7.7 or later.\n- Disable the search.suggest feature in mkdocs.yml if an upgrade is not immediately possible.\n\n**Remediation Steps:**\n1. Verify current Material for MkDocs version.\n2. Update the package using pip install --upgrade mkdocs-material>=9.7.7.\n3. If immediate upgrade is impossible, open mkdocs.yml, locate 'features' list under 'theme', and comment out '- search.suggest'.\n4. Rebuild and redeploy the documentation site.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf)\n- [NVD CVE-2026-73295 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-73295)\n- [Official Patch Commit](https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25)\n- [Release Notes (v9.7.7)](https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73295) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T20:32:54.881615Z"} 2026-09-03T20:32:54.881615+00:00