{"metadata": {"vulnerability": "CVE-2026-73295", "count": 19, "kinds": {"milestone": 7, "sighting": 1, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-08-11T19:42:11.450Z", "date_only": false, "value": "2026-08-11T19:42:11.450Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-73295", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-12T16:15:22.470Z", "date_only": false, "value": "2026-08-12T16:15:22.470Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-73295", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-08-12T16:15:22.470Z", "date_only": false, "value": "2026-08-12T16:15:22.470Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-73295", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-12T17:17:00Z", "date_only": false, "value": "2026-08-12T17:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-73295", "record": "UBUNTU-CVE-2026-73295", "field": "published"}, {"timestamp": "2026-08-12T17:17:32Z", "date_only": false, "value": "2026-08-12T17:17:32Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XVG9-69GF-FJRF", "record": "GHSA-XVG9-69GF-FJRF", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-08-12T17:17:32.637Z", "date_only": false, "value": "2026-08-12T17:17:32.637", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73295", "record": "FKIE_CVE-2026-73295", "field": "published"}, {"timestamp": "2026-08-13T16:24:55.991Z", "date_only": false, "value": "2026-08-13T16:24:55.991442Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-73295", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-13T16:24:55.991Z", "date_only": false, "value": "2026-08-13T16:24:55.991442Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73295", "record": "FKIE_CVE-2026-73295", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-08-13T16:25:06.938Z", "date_only": false, "value": "2026-08-13T16:25:06.938Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-73295", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-13T16:25:06.938Z", "date_only": false, "value": "2026-08-13T16:25:06.938Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-73295", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-03T19:52:32Z", "date_only": false, "value": "2026-09-03T19:52:32Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XVG9-69GF-FJRF", "record": "GHSA-XVG9-69GF-FJRF", "field": "published"}, {"timestamp": "2026-09-03T19:52:32Z", "date_only": false, "value": "2026-09-03T19:52:32Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XVG9-69GF-FJRF", "record": "GHSA-XVG9-69GF-FJRF", "field": "modified"}, {"timestamp": "2026-09-03T20:32:54.881Z", "date_only": false, "value": "2026-09-03T20:32:54.881615Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/b48a4802ab7de78f3b7bc06aac45d10c", "record": "CVE-2026-73295", "field": "creation_timestamp", "uuid": "932572e2-c120-415b-a17a-ad97d6b7fa9b", "content": "# CVE-2026-73295: CVE-2026-73295: DOM-based Cross-Site Scripting (XSS) in Material for MkDocs Search Suggestions\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-73295\n\n## Summary\nCVE-2026-73295 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Material for MkDocs versions 7.2.0 through 9.7.6. When the optional 'search.suggest' feature is enabled, the client-side 'mountSearchSuggest' function processes user-controlled inputs from the URL 'q' parameter and writes them directly to the DOM using an unsafe innerHTML sink without sanitization.\n\n## TL;DR\nA DOM-based XSS vulnerability in Material for MkDocs (v7.2.0 to v9.7.6) allows unauthenticated remote attackers to execute arbitrary JavaScript in the victim's browser context via a crafted query parameter when the optional search suggestion feature is enabled.\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.4 (Medium)\n- **EPSS Score**: 0.00185 (0.185%)\n- **Impact**: DOM-based Cross-Site Scripting (XSS)\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Material for MkDocs with search.suggest feature enabled\n- **Material for MkDocs**: >= 7.2.0, < 9.7.7 (Fixed in: `9.7.7`)\n\n## Mitigation\n\n- Upgrade Material for MkDocs to version 9.7.7 or later.\n- Disable the search.suggest feature in mkdocs.yml if an upgrade is not immediately possible.\n\n**Remediation Steps:**\n1. Verify current Material for MkDocs version.\n2. Update the package using pip install --upgrade mkdocs-material>=9.7.7.\n3. If immediate upgrade is impossible, open mkdocs.yml, locate 'features' list under 'theme', and comment out '- search.suggest'.\n4. Rebuild and redeploy the documentation site.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf)\n- [NVD CVE-2026-73295 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-73295)\n- [Official Patch Commit](https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25)\n- [Release Notes (v9.7.7)](https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-73295) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/b48a4802ab7de78f3b7bc06aac45d10c"}, {"timestamp": "2026-09-04T09:32:39Z", "date_only": false, "value": "2026-09-04T09:32:39Z", "kind": "milestone", "label": "Published", "source": "osv_homebrew \u00b7 BREW-MKDOCS-MATERIAL-CVE-2026-73295", "record": "BREW-MKDOCS-MATERIAL-CVE-2026-73295", "field": "published"}, {"timestamp": "2026-09-09T21:02:22.660Z", "date_only": false, "value": "2026-09-09T21:02:22.660", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73295", "record": "FKIE_CVE-2026-73295", "field": "lastModified"}, {"timestamp": "2026-09-10T09:44:59.923Z", "date_only": false, "value": "2026-09-10T09:44:59.923933Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-3864", "record": "PYSEC-2026-3864", "field": "published"}, {"timestamp": "2026-09-10T11:02:14.383Z", "date_only": false, "value": "2026-09-10T11:02:14.383939Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-3864", "record": "PYSEC-2026-3864", "field": "modified"}, {"timestamp": "2026-09-10T19:59:00Z", "date_only": false, "value": "2026-09-10T19:59:00Z", "kind": "other", "label": "Updated", "source": "osv_homebrew \u00b7 BREW-MKDOCS-MATERIAL-CVE-2026-73295", "record": "BREW-MKDOCS-MATERIAL-CVE-2026-73295", "field": "modified"}, {"timestamp": "2026-10-17T09:51:13Z", "date_only": false, "value": "2026-10-17T09:51:13Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-73295", "record": "UBUNTU-CVE-2026-73295", "field": "modified"}]}