Medium, CVSS 5.4npmAmendedPublished
devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs
GHSA-hvqh-jw65-wcpq
- Affected
- npm devbridge-autocomplete <= 2.0.0
- Fixed in
- 2.0.1· Vendor fix available
- Issue
- The default formatGroup and formatResult functions in devbridge-autocomplete concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion data source. Details 1. formatGroup — category is interpolated raw. src/format.ts: If groupBy is used and the grouping field of any suggestion contains HTML, that HTML is executed. 2. formatResult — early-return branch returns suggestion.value raw. src/format.ts: The early-return branch is reached when suggest() renders with an empty currentValue, which happens with minChars: 0 and a server that returns suggestions for an empty query. The returned string is concatenated into the container's innerHTML. PoC (formatGroup) Originally identified by an earlier human analysis; the PoC above was produced with the assistance of Claude Opus 4.7. Impact XSS in pages that render attacker-controllable suggestion data. The actual impact depends on what the embedding page has access to (cookies,…
Recommended action: Upgrade to 2.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.