Executive brief
devbridge-autocomplete is a JavaScript library that provides autocomplete functionality for web forms. The library's default formatting functions fail to escape HTML in user-supplied suggestion data, allowing attackers who control the data source to inject malicious scripts that execute in users' browsers. This could lead to theft of session cookies, credentials, or other sensitive data from pages using the library.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the formatGroup and formatResult functions in src/format.ts. The formatGroup function concatenates an unescaped category parameter directly into HTML output; if groupBy is configured and the grouping field contains HTML/JavaScript, it executes in the page. The formatResult function has an early-return branch that returns suggestion.value unescaped when currentValue is empty—reachable with minChars: 0 and a server returning suggestions for empty queries. Both outputs are injected into the container's innerHTML. The vulnerability requires network access and user interaction (triggering autocomplete), but no authentication or elevated privileges. An attacker controlling the suggestion data source can achieve stored or reflected XSS. Fixed in version 2.0.1 via proper HTML escaping using document.createElement and textContent.
Affected products
- devbridge jQuery-Autocomplete through 2.0.0
Timeline
- 2026-05-21: disclosed
- 2026-05-21: patched: Fixed in version 2.0.1
- 2026-06-22: advisory