Coordinated Disclosure Timeline

• 2026-07-16: Reported vulnerability to Maintainer via Email.
• 2026-07-19: Fix was released with advisory.

Summary

mkdocs-material’s search suggestion allowed crafted links to execute JavaScript in the origin of documentation sites that enable the feature.

Project

mkdocs-material

Tested Version

5b36f2ac499a45905e246bc66bbee2858ef6556f (also confirmed on 9.5.49 and 9.7.6)

Details

DOM-based XSS in search-suggest component via unescaped ?q= URL parameter written to innerHTML (GHSL-2026-151)

In src/templates/assets/javascripts/components/search/suggest/index.ts#L116-L119, the joined words (derived from the search <input> value, itself seeded from the visitor-controlled ?q= URL parameter by watchSearchQuery at components/search/query/index.ts:107-112) is written directly to innerHTML with no HTML-escaping — only whitespace is transformed:

.subscribe(words => el.innerHTML = words.join("").replace(/\s/g, " "))

The compiled bundle material/templates/assets/javascripts/bundle.79ae519e.min.js contains the identical e.innerHTML=a.join("").replace(/\s/g," ") write. The vulnerability has existed since the search.suggest feature was introduced in v7.2.0 (commit d68fe9102a21, 2021-07-21).

A --prefixed clause containing an HTML payload is filtered out of the Lunr clause list by integrations/search/_/index.ts:309-324 when computing the suggest array, so the payload need not prefix-match anything in the search index — only the trailing (non-prohibited) token does. The payload is nonetheless preserved verbatim in query.value and re-emitted into words for the innerHTML sink.

Impact

Arbitrary JavaScript execution in the victim’s browser under the documentation site’s origin. An attacker who lures a visitor to a crafted ?q= link can read/write same-origin localStorage (__consent, __palette, __announce), read/exfiltrate same-origin cookies, issue same-origin requests, and render phishing UI on a trusted docs.<company>.tld origin. Impact is amplified when documentation is served on the same origin (or shared parent domain) as an authenticated application. Present in every release from v7.2.0 through 9.7.6 (~5 years).

CWEs

• CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

  CVE

• CVE-2026-73295

Credit

This issue was discovered with the GitHub Security Lab Taskflow Agent as part of Project Glasswing, a cross-industry initiative to secure critical open-source software using frontier AI models, and manually verified by @p- (Peter Stöckli).

Contact

You can contact the GHSL team at securitylab@github.com, please include a reference to GHSL-2026-151 in any communication regarding this issue.