PT-2026-107302

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.14.6 Backstage versions prior to 1.15.4 Description The @backstage/plugin-techdocs-node package contains a flaw in the techdocs backend that allows a bypass of the mkdocs configuration sanitizer. Users capable of...

CVE-2026-106505: Untrusted Search Path

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users with the ability to commit changes to a repository that uses TechDocs can...

CVE-2026-106455: Server-Side Request Forgery (SSRF)

Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository...

PT-2026-107304

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.15.4 Description The @backstage/plugin-techdocs-node package contains an arbitrary file read flaw. Unsafe path resolution during the handling of the TechDocs source tree allows an authenticated user with permissio...

PYSEC-2026-3864 Material for MkDocs: DOM XSS in search suggestions via query parameter

Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. Patches The issue is fixed in Material for...

adeso (>=0.0.1, <=0.0.4), adze-modeler (0.0.1) +137 more potentially affected by CVE-2026-73295 via mkdocs-material (>=7.2.2, <=9.7.6)

mkdocs-material PYPI version =7.2.2, =0.0.1, =0.0.0, =0.10.0, =0.5.0a1, =0.3.1b1, =0.0.45, =1.6.4b1, =0.1.0, =0.0.34, =0.0.36 and more Source cves: CVE-2026-73295 Source advisory: OSV:PYSEC-2026-3864...

Material for MkDocs: DOM XSS in search suggestions via query parameter

ImpactMaterial for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. PatchesThe issue is fixed in Material for...

EUVD-2026-57321

Material for MkDocs: DOM XSS in search suggestions via query parameter...

adeso (>=0.0.1, <=0.0.4), adze-modeler (0.0.1) +137 more potentially affected by CVE-2026-73295 via mkdocs-material (>=7.2.2, <=9.7.6)

mkdocs-material PYPI version =7.2.2, =0.0.1, =0.0.0, =0.10.0, =0.5.0a1, =0.3.1b1, =0.0.45, =1.6.4b1, =0.1.0, =0.0.34, =0.0.36 and more Source cves: CVE-2026-73295 Source advisory: OSV:GHSA-XVG9-69GF-FJRF...

adeso (>=0.0.1, <=0.0.4), adze-modeler (0.0.1) +137 more potentially affected by CVE-2026-73295 via mkdocs-material (>=7.2.2, <=9.7.6)

mkdocs-material PYPI version =7.2.2, =0.0.1, =0.0.0, =0.10.0, =0.5.0a1, =0.3.1b1, =0.0.45, =1.6.4b1, =0.1.0, =0.0.34, =0.0.36 and more Source cves: CVE-2026-73295 Source advisory: GHSA-XVG9-69GF-FJRF...

GHSA-XVG9-69GF-FJRF Material for MkDocs: DOM XSS in search suggestions via query parameter

Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. Patches The issue is fixed in Material for...

Material for MkDocs: DOM XSS in search suggestions via query parameter

Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. Patches The issue is fixed in Material for...

[SECURITY] Fedora 44 Update: python-mkdocs-git-revision-date-localized-plugin-1.5.4-1.fc44

This package is a MkDocs plugin that enables displaying the date of the last git modification of a page. The plugin uses babel and timeago.js to provide different localized date formats. It was originally forked from mkdocs-git-revision-date-plugin...

Fedora 44 : python-mkdocs-git-revision-date-localized-plugin (2026-c10d41473a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c10d41473a advisory. Update to v1.5.4 a2313a3 Security Raises the gitpython floor from =3.1.44 to =3.1.59. Earlier dependabot bumps only touched this repo's uv.lock, which pins t...

CVE-2026-73295

A flaw was found in Material for MkDocs. A DOM-based Cross-Site Scripting XSS vulnerability exists in the search suggestion feature. A remote attacker could exploit this by crafting a malicious URL with a specially designed query parameter. After user interaction, this could lead to the execution...

SUSE CVE-2026-73295

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest...

Cross-site Scripting (XSS)

Overview mkdocs-material is a security holding package Affected versions of this package are vulnerable to Cross-site Scripting XSS via the mountSearchSuggest function. An attacker can execute arbitrary JavaScript in the context of the documentation site's origin by crafting a malicious q URL...

Cross-site Scripting (XSS)

Overview mkdocs-material is a Documentation that simply works Affected versions of this package are vulnerable to Cross-site Scripting XSS via the mountSearchSuggest function. An attacker can execute arbitrary JavaScript in the context of the documentation site's origin by crafting a malicious q...

adeso (>=0.0.1, <=0.0.4), aiagents4pharma (>=0.0.0, <=1.49.1) +73 more potentially affected by CVE-2026-73295 via mkdocs-material (>=9.1.2, <=9.7.6)

mkdocs-material PYPI version =9.1.2, =0.0.1, =0.0.0, =0.10.0, =0.5.0a1, =0.1.0, =0.0.34, =0.7.0, =1.1.0, =2025.9.131446, =2025.9.191330 and more Source cves: CVE-2026-73295 Source advisory: SNYK:PYTHON-MKDOCSMATERIAL-18752056...

CVE-2026-73295

Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest...