Mkdocs Material
Monthly
DOM-based cross-site scripting in Material for MkDocs versions 7.2.0 through 9.7.6 allows remote attackers to execute arbitrary JavaScript within a documentation site's origin by crafting a malicious `q` URL parameter targeting the optional search.suggest feature, which requires a single click from the victim to trigger. The vulnerability is confined to sites that have explicitly enabled the search.suggest feature, and exploitation results in Low confidentiality and integrity impact scoped to the affected origin. No public exploit code or active exploitation (CISA KEV) has been identified; the vendor released a confirmed patch in version 9.7.7.
DOM-based cross-site scripting in Material for MkDocs versions 7.2.0 through 9.7.6 allows remote attackers to execute arbitrary JavaScript within a documentation site's origin by crafting a malicious `q` URL parameter targeting the optional search.suggest feature, which requires a single click from the victim to trigger. The vulnerability is confined to sites that have explicitly enabled the search.suggest feature, and exploitation results in Low confidentiality and integrity impact scoped to the affected origin. No public exploit code or active exploitation (CISA KEV) has been identified; the vendor released a confirmed patch in version 9.7.7.