{"id":"GHSA-hvqh-jw65-wcpq","title":"devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs","summary":"devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs","severity":"medium","cvss":5.4,"cwe":["CWE-79"],"vendor":"devbridge-autocomplete","product":"devbridge-autocomplete","ecosystem":"npm","affected":["devbridge-autocomplete <= 2.0.0"],"patched":["devbridge-autocomplete 2.0.1"],"published":"2026-06-22","updated":"2026-06-22","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-hvqh-jw65-wcpq","references":[{"url":"https://github.com/devbridge/jQuery-Autocomplete/security/advisories/GHSA-hvqh-jw65-wcpq"},{"url":"https://github.com/devbridge/jQuery-Autocomplete/commit/63ff096ff5b77a90aac7fb5dad7c86e538a59ce0"},{"url":"https://github.com/advisories/GHSA-hvqh-jw65-wcpq"}],"tags":["ghsa","npm"],"ingestedAt":"2026-06-29T13:24:35.493Z","slug":"GHSA-hvqh-jw65-wcpq","body":"## Overview\n\n### Summary\n\nThe default `formatGroup` and `formatResult` functions in `devbridge-autocomplete` concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion data source.\n\n### Details\n\n**1. `formatGroup` — `category` is interpolated raw.**\n\n`src/format.ts`:\n\n```ts\nfunction formatGroup(suggestion, category) {\n return '
' + category + '
';\n}\n```\n\nIf `groupBy` is used and the grouping field of any suggestion contains HTML, that HTML is executed.\n\n**2. `formatResult` — early-return branch returns `suggestion.value` raw.**\n\n`src/format.ts`:\n\n```ts\nfunction formatResult(suggestion, currentValue) {\n if (!currentValue) {\n return suggestion.value; // un-escaped\n }\n /* ... non-empty path escapes correctly ... */\n}\n```\n\nThe early-return branch is reached when `suggest()` renders with an empty `currentValue`, which happens with `minChars: 0` and a server that returns suggestions for an empty query. The returned string is concatenated into the container's `innerHTML`.\n\n### PoC (formatGroup)\n\n```html\n\n\n\n \n PoC: formatGroup XSS in jQuery-Autocomplete v2.0.0\n\n\n \n\n \n \n \n\n\n```\n\nOriginally identified by an earlier human analysis; the PoC above was produced with the assistance of Claude Opus 4.7.\n\n### Impact\n\nXSS in pages that render attacker-controllable suggestion data. The actual impact depends on what the embedding page has access to (cookies, session tokens, DOM), per standard reflected/stored XSS.\n\n### Patch\n\nBoth formatters now run their interpolated input through the browser's text-node escaping (`createElement` + `textContent`) before producing the HTML string. Fixed in version `2.0.1`.\n\n## Affected packages\n\n- `devbridge-autocomplete <= 2.0.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `devbridge-autocomplete 2.0.1`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}