Tools AI-Found Vulnerability Register aifv-0112
Register entry
MkDocs Material: DOM-based cross-site scripting
- CVE
- CVE-2026-73295
- GHSA
- GHSA-xvg9-69gf-fjrf
- Project
- MkDocs Material
- Component
- MkDocs Material
- Finder
- Taskflow Agent
- Autonomy
- AI discovery with manual human verification
- Evidence tier
- Claim outside the record
- Assigner
- GitHub_M
- Confidence
- CONFIRMED
What happened
GitHub Security Lab attributes this finding to its Taskflow Agent, with human verification.
Credit as recorded: null. The maintainer lists affected versions >=7.2.0,<9.7.7 and patched version 9.7.7. Its advisory was published on 17 July; GHSL’s timeline places the released fix on 19 July. The public disclosure explicitly crediting the AI agent was published on 22 October. These dates describe different events. Date basis: GHSL disclosure explicitly attributing AI discovery.
Sources
- GitHub Security Lab disclosuresecuritylab.github.com/advisories/GHSL-2026-151_mkdocs-mater…
- Maintainer advisorygithub.com/squidfunk/mkdocs-material/security/advisories/GHS…
One record from the AI-Found Vulnerability Register, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026