Description

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature that allows a crafted q URL parameter to execute JavaScript in a documentation site's origin after user interaction. This issue is fixed in version 9.7.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-12T17:17:32.637Z",
  "pubdate": "2026-08-12T17:17:32.637Z",
  "executiveSummary": "A DOM-based cross-site scripting (XSS) vulnerability exists within the optional search.suggest feature of Material for MkDocs. Specifically, the flaw resides in the mountSearchSuggest function located at src/templates/assets/javascripts/components/search/suggest/index.ts. This security defect allows a maliciously crafted q URL parameter to execute arbitrary JavaScript within the origin context of the affected documentation site.\nThe impact of successful exploitation includes the potential execution of malicious scripts in the victim's browser session, leading to potential session hijacking, data theft, or unauthorized actions performed on behalf of the user within the site's origin. The vulnerability affects Material for MkDocs versions 7.2.0 through 9.7.7.\nExploitation requires user interaction, typically involving the victim navigating to a specially crafted URL containing malicious payloads within the search query parameter. Authentication and specific privilege levels are generally not required to trigger the unauthenticated client-side vulnerability, provided the optional search.suggest feature is enabled on the documentation site.",
  "technicalDetails": "The vulnerability is classified as a DOM-based cross-site scripting (XSS) flaw, stemming from insecure handling of client-side data within the search suggestion component. The vulnerable component is identified as the mountSearchSuggest function implemented in src/templates/assets/javascripts/components/search/suggest/index.ts.\nThe root cause involves the improper sanitization and handling of input derived from the query parameter q. When a user interacts with a documentation site loaded with a maliciously crafted URL, the search suggestion functionality dynamically processes and renders the untrusted input directly into the Document Object Model (DOM) without adequate escaping or contextual output encoding.\nThe attack flow proceeds as follows: an attacker crafts a malicious URL targeting a documentation site utilizing Material for MkDocs with the optional search.suggest feature enabled. The URL incorporates an exploit payload within the q parameter. Upon the victim clicking or navigating to this crafted URL, the client-side JavaScript execution environment invokes the mountSearchSuggest function. This function reads the untrusted q parameter and improperly integrates it into the DOM structure.\nBecause the payload is not properly neutralized, the browser interprets the injected strings as executable code rather than plain text or inert markup. Consequently, the injected JavaScript executes within the security context and origin of the target documentation site.\nAffected versions span from 7.2.0 up to and including 9.7.7. The issue requires no prior authentication or administrative privileges, relying entirely on network exposure of the static or dynamic documentation site and victim interaction with the malicious URL. Post-exploitation impact is localized to the victim's browser session, allowing execution of arbitrary scripts, access to document cookies, local storage manipulation, or interaction with underlying application programming interfaces exposed in the same origin."
}