The vulnerability identified as CVE-2026-73295 affects the mountSearchSuggest function in the JavaScript component of squidfunk mkdocs-material from versions 7.2.0 up to but not including 9.7.7. It is a DOM-based cross-site scripting flaw (CWE-79) where the optional search.suggest feature improperly neutralizes input from the 'q' URL parameter, enabling an attacker to execute arbitrary JavaScript in the user's browser within the documentation site's origin after the user interacts with the search feature. This could lead to limited confidentiality and integrity impacts. The vulnerability has a CVSS 3.1 base score of 5.4 (medium severity).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the documentation site, potentially leading to limited confidentiality and integrity impacts such as theft of sensitive information or manipulation of the page content. There is no indication of availability impact. No known exploits in the wild have been reported.

Upgrade mkdocs-material to version 9.7.7 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Patch status is confirmed fixed in 9.7.7.