py-mkdocs-material -- DOM XSS vulnerability

2026-07-31 · VuXML entry

Martin Donath reports: Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction.

Affected versions

• py310-mkdocs-material, py311-mkdocs-material, py312-mkdocs-material, py313-mkdocs-material, py313t-mkdocs-material, py314-mkdocs-material, py314t-mkdocs-material, py315-mkdocs-material < 9.7.7

By system

1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.