[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mkdocs-material (changelog)	9.7.6 → 9.7.7

---

Material for MkDocs: DOM XSS in search suggestions via query parameter

CVE-2026-73295 / GHSA-xvg9-69gf-fjrf

More information

Details

Impact

Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction.

Patches

The issue is fixed in Material for MkDocs 9.7.7. Users should upgrade to 9.7.7 or later.

Workarounds

Sites unable to upgrade should disable the search.suggest feature.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

• https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf
• https://nvd.nist.gov/vuln/detail/CVE-2026-73295
• https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25
• https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7
• https://github.com/advisories/GHSA-xvg9-69gf-fjrf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

• If you want to rebase/retry this PR, check this box

[github-actions]

🎉 Welcome @renovate[bot]! Thank you for your first pull request to mars! We're excited to have you as a contributor. Our team will review your PR soon. In the meantime, please ensure all CI checks pass.

[github-actions]

This PR has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.