CVE-2026-73295

The CVSS 5.4 assigned to CVE-2026-73295 understates the actual risk profile you need to evaluate. This DOM-based cross-site scripting vulnerability exists in Material for MkDocs' search.suggest feature—a component that is technically optional but behaves as a de facto default in many production deployments because operators inherit configurations from quickstart guides and shared templates without auditing what each setting does. The critical question is not whether this is a medium-severity vulnerability in an optional feature. The critical question is whether your organization can reliably answer whether any of your MkDocs instances have search.suggest enabled. If you cannot enumerate which deployments carry this feature, treat the vulnerability as active until proven otherwise. The feature was introduced in version 7.2.0 and remained vulnerable through 9.7.7—meaning you are likely dealing with years of potential exposure across documentation sites that may have been stood up, inherited by other teams, and never revisited. Beyond the asset visibility gap, recognize the blast radius asymmetry. Documentation portals are trust anchors in organizational infrastructure: they often host API references, integrate with SSO, and link to internal tooling. A DOM-based XSS executing in a user's authenticated session on your developer documentation portal has access to a context that holds session tokens, embedded credentials in internal links, and cross-origin trust relationships with CI/CD systems. The CVSS score treats this as an isolated XSS; in practice, it is a potential pivot point into workflows your organization depends on. Detection will be difficult. DOM-based XSS leaves no server-side artifacts—your WAF and log monitoring will not see exploitation attempts. The EPSS score of 0.00185 reflects general internet exploitation probability, not the specific exposure profile of documentation-heavy organizations where this feature may be widely enabled through institutional templates. Your immediate actions: audit all MkDocs deployments for search.suggest configuration, prioritize patching instances where it is enabled, and treat this as higher-than-CVSS priority because the forensic trail for this vulnerability is minimal. If you discover this feature was active in past deployments, treat the compromise window as potentially already realized.

Reviewed through automated stages and approved by a human before publication.