The vulnerability is a DOM‑based cross‑site scripting flaw that arises when a user interacts with the optional search.suggest feature in MkDocs Material. A malicious actor can supply a crafted "q" query parameter that causes arbitrary inline JavaScript to be executed within the context of the documentation site's origin. This flaw enables an attacker to hijack user sessions, deface content, or exfiltrate data visible to site visitors. The weakness is of type CWE‑79.

The issue affects MkDocs Material versions from 7.2.0 through 9.7.7 inclusive. The most common affected distribution is the Python package "squidfunk:mkdocs-material". Affected sites are those hosting documentation built with these versions, regardless of operating system or hosting platform.

The CVSS score of 5.4 places the vulnerability in the moderate severity range. Exploit likelihood is not quantified in EPSS, and the flaw is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to host a maliciously crafted URL that includes the vulnerable "q" parameter and persuade a user to click or otherwise interact with the rendered page. Because the code runs once the user interacts with the interface, the vulnerability falls under a user‑initiated scenario rather than remote code upload or denial of service.