Executive brief
A cross-site scripting (XSS) vulnerability exists in the devbridge-autocomplete library, which is used to provide search suggestion functionality on websites. If an attacker can control the data used for these suggestions, they can execute malicious scripts in the browser of users interacting with the search bar. This could lead to unauthorized actions, theft of session cookies, or the defacement of the affected web page.
Technical details
A cross-site scripting (XSS) vulnerability exists in devbridge-autocomplete versions up to 2.0.0. The root cause is the lack of HTML escaping in the default 'formatGroup' and 'formatResult' functions within 'src/format.ts'. Specifically, 'formatGroup' interpolates the 'category' field raw, and 'formatResult' returns 'suggestion.value' unescaped when 'currentValue' is empty (e.g., with 'minChars: 0'). An attacker who can influence the suggestion data source can inject malicious HTML/JavaScript that executes in the context of the user's browser. The issue is fixed in version 2.0.1 by implementing proper text-node escaping.
Affected products
- devbridge devbridge-autocomplete <= 2.0.0
Timeline
- 2026-05-21: disclosed
- 2026-06-22: advisory: GitHub Advisory published
- 2026-06-22: patched: Fixed in version 2.0.1
References
- https://api.github.com/users/junowilderness
- https://github.com/junowilderness
- https://api.github.com/users/junowilderness/gists%7B/gist_id%7D
- https://api.github.com/users/junowilderness/repos
- https://avatars.githubusercontent.com/u/1977311?v=4
- https://api.github.com/users/junowilderness/events%7B/privacy%7D