---
id: GHSA-hvqh-jw65-wcpq
title: >-
devbridge-autocomplete has XSS in its default formatters: formatGroup and
formatResult fail to escape HTML in untrusted inputs
summary: >-
devbridge-autocomplete has XSS in its default formatters: formatGroup and
formatResult fail to escape HTML in untrusted inputs
severity: medium
cvss: 5.4
cwe:
- CWE-79
vendor: devbridge-autocomplete
product: devbridge-autocomplete
ecosystem: npm
affected:
- devbridge-autocomplete <= 2.0.0
patched:
- devbridge-autocomplete 2.0.1
published: '2026-06-22'
updated: '2026-06-22'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-hvqh-jw65-wcpq'
references:
- url: >-
https://github.com/devbridge/jQuery-Autocomplete/security/advisories/GHSA-hvqh-jw65-wcpq
- url: >-
https://github.com/devbridge/jQuery-Autocomplete/commit/63ff096ff5b77a90aac7fb5dad7c86e538a59ce0
- url: 'https://github.com/advisories/GHSA-hvqh-jw65-wcpq'
tags:
- ghsa
- npm
ingestedAt: '2026-06-29T13:24:35.493Z'
---
## Overview
### Summary
The default `formatGroup` and `formatResult` functions in `devbridge-autocomplete` concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion data source.
### Details
**1. `formatGroup` — `category` is interpolated raw.**
`src/format.ts`:
```ts
function formatGroup(suggestion, category) {
return '
' + category + '
';
}
```
If `groupBy` is used and the grouping field of any suggestion contains HTML, that HTML is executed.
**2. `formatResult` — early-return branch returns `suggestion.value` raw.**
`src/format.ts`:
```ts
function formatResult(suggestion, currentValue) {
if (!currentValue) {
return suggestion.value; // un-escaped
}
/* ... non-empty path escapes correctly ... */
}
```
The early-return branch is reached when `suggest()` renders with an empty `currentValue`, which happens with `minChars: 0` and a server that returns suggestions for an empty query. The returned string is concatenated into the container's `innerHTML`.
### PoC (formatGroup)
```html
PoC: formatGroup XSS in jQuery-Autocomplete v2.0.0
```
Originally identified by an earlier human analysis; the PoC above was produced with the assistance of Claude Opus 4.7.
### Impact
XSS in pages that render attacker-controllable suggestion data. The actual impact depends on what the embedding page has access to (cookies, session tokens, DOM), per standard reflected/stored XSS.
### Patch
Both formatters now run their interpolated input through the browser's text-node escaping (`createElement` + `textContent`) before producing the HTML string. Fixed in version `2.0.1`.
## Affected packages
- `devbridge-autocomplete <= 2.0.0`
## Remediation
Upgrade to a patched release:
- `devbridge-autocomplete 2.0.1`