EUVD-2026-57321Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network-delivered URL-based XSS, no privileges or complexity required, user click mandatory, impact confined to documentation site origin with no availability effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature that allows a crafted q URL parameter to execute JavaScript in a documentation site's origin after user interaction. This issue is fixed in version 9.7.7.
AnalysisAI
DOM-based cross-site scripting in Material for MkDocs versions 7.2.0 through 9.7.6 allows remote attackers to execute arbitrary JavaScript within a documentation site's origin by crafting a malicious q URL parameter targeting the optional search.suggest feature, which requires a single click from the victim to trigger. The vulnerability is confined to sites that have explicitly enabled the search.suggest feature, and exploitation results in Low confidentiality and integrity impact scoped to the affected origin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The optional search.suggest feature must be explicitly configured and enabled in the site's mkdocs.yml - it is not active by default, which substantially narrows the vulnerable population. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.4 (Medium) reflects a network-delivered, low-complexity attack requiring no privileges but necessitating user interaction (UI:R), with unchanged scope and only Low confidentiality and integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a public documentation site built with Material for MkDocs 7.2.0-9.7.6 that has search.suggest enabled, then crafts a URL embedding a JavaScript payload in the `q` query parameter. The attacker distributes this link via phishing email, issue tracker comment, or social media targeting the site's users; when a victim clicks the link, their browser processes the parameter through `mountSearchSuggest`, executing the payload in the documentation site's origin and potentially exfiltrating any cookies or tokens scoped to that domain. … |
| Remediation | Vendor-released patch: version 9.7.7, available at https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7 and confirmed by fix commit 52fb6be8aafe326419f34dc94d3211e7bbfbfb25. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today