devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs
Date: 2026-06
Affected: npm/devbridge-autocomplete
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CWE: CWE-79
CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

### Summary The default `formatGroup` and `formatResult` functions in `devbridge-autocomplete` concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion data source. ### Details **1. `formatGroup` — `category` is interpolated raw.** `src/format.ts`: ```ts function formatGroup(suggestion, category) { return '<div class="autocomplete-group">' + category + '</div>'; } ``` If `groupBy` is used and the grouping field of any suggestion contains HTML, that HTML is executed. **2. `formatResult` — early-return branch returns `suggestion.value` raw.** `src/format.ts`: ```ts function formatResult(suggestion, currentValue) { if (!currentValue) { return suggestion.value; // un-escaped } /* ... non-empty path escapes correctly ... */ } ``` The early-return branch is reached when `suggest()` renders with an empty `currentValue`, which happens with `minChars: 0` and a server that returns suggestions for an empty query. The returned string is concatenated into the container's `innerHTML`. ### PoC (formatGroup) ```html <!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>PoC: formatGroup XSS in jQuery-Autocomplete v2.0.0</title> </head> <body> <input id="ac" type="text" placeholder="Type 'a' to trigger" autocomplete="off"> <script src="https://code.jquery.com/jquery-3.7.1.min.js"></script> <script src="dist/jquery.autocomplete.js"></script> <script> var poison


Mitigations:

Architectural layers (MAESTRO):