In Materialize up to and including 1.0.0, XSS is possible via the Autocomplete feature.
materializecss materialize