Bug 2514806 (CVE-2026-73295)
| Summary: | CVE-2026-73295 mkdocs-material: Material for MkDocs: DOM-based Cross-Site Scripting via crafted URL parameter | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abarbaro, alizardo, dfreiber, drow, dschmidt, jburrell, jchui, jhe, jlanda, kshier, ktsao, nboldt, oaljalju, psrna, simaishi, stcannon, teagle, vkumar, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Material for MkDocs. A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the search suggestion feature. A remote attacker could exploit this by crafting a malicious URL with a specially designed query parameter. After user interaction, this could lead to the execution of arbitrary JavaScript code in the context of the documentation site, potentially resulting in information disclosure or other client-side attacks.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-08-12 16:21:18 UTC
|