CVE-2026-73295 squidfunk CVE debrief

Who should care

Defenders responsible for MkDocs deployments should assess exposure and apply the fix. They should prioritize verifying exposure of the search.suggest feature in their MkDocs deployments and apply the fix in version 9.7.7 to prevent potential JavaScript execution. This includes reviewing the current version of Material for MkDocs in use and determining if the search.suggest feature is enabled.

Why it matters

Defenders should prioritize verifying exposure of the search.suggest feature in their MkDocs deployments and apply the fix in version 9.7.7 to prevent potential JavaScript execution.

• User interaction is required to trigger the vulnerability
• JavaScript execution can occur in the documentation site's origin
• The vulnerability is fixed in version 9.7.7

Technical summary

The mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter can execute JavaScript in a documentation site's origin after user interaction. The vulnerability requires user interaction to trigger and can lead to JavaScript execution in the documentation site's origin. The fix is verified in version 9.7.7 of Material for MkDocs, which removes the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of the search.suggest feature in their MkDocs deployments and apply the fix in version 9.7.7.

Recommended defensive actions

• Verify exposure of the search.suggest feature in MkDocs deployments
• Apply the fix in version 9.7.7
• Monitor for potential user interactions that could trigger the vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version. The vulnerability is confirmed in versions 7.2.0 through 9.7.6 of Material for MkDocs. The fix is verified in version 9.7.7. Defenders should verify the exposure of the search.suggest feature in their MkDocs deployments and apply the fix.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.