Skip to content
Fencer Intel
medium 5.4

GHSA-hvqh-jw65-wcpq json

devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs

published 4mo ago modified 4mo ago

cvss
5.4
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Summary

The default `formatGroup` and `formatResult` functions in `devbridge-autocomplete` concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion data source.

### Details

**1. `formatGroup` — `category` is interpolated raw.**

`src/format.ts`:

```ts function formatGroup(suggestion, category) { return '<div class="autocomplete-group">' + category + '</div>'; } ```

If `groupBy` is used and the grouping field of any suggestion contains HTML, that HTML is executed.

**2. `formatResult` — early-return branch returns `suggestion.value` raw.**

`src/format.ts`:

```ts function formatResult(suggestion, currentValue) { if (!currentValue) { return suggestion.value; // un-escaped } /* ... non-empty path escapes correctly ... */ } ```

The early-return branch is reached when `suggest()` renders with an empty `currentValue`, which happens with `minChars: 0` and a server that returns suggestions for an empty query. The returned string is concatenated into the container's `innerHTML`.

### PoC (formatGroup)

```html <!DOCTYPE html> <html> <head> <meta charset="utf-8"> <title>PoC: formatGroup XSS in jQuery-Autocomplete v2.0.0</title> </head> <body> <input id="ac" type="text" placeholder="Type 'a' to trigger" autocomplete="off">

<script src="https://code.jquery.com/jquery-3.7.1.min.js"></script> <script src="dist/jquery.autocomplete.js"></script> <script> var poisoned = [ { value: 'Apple', data: { category: "<img src=x onerror=\"alert('XSS via formatGroup')\">" } }, { value: 'Avocado', data: { category: 'Safe Group' } } ];

$('#ac').devbridgeAutocomplete({ lookup: poisoned, groupBy: 'category', minChars: 1 }); </script> </body> </html> ```

Originally identified by an earlier human analysis; the PoC above was produced with the assistance of Claude Opus 4.7.

### Impact

XSS in pages that render attacker-controllable suggestion data. The actual impact depends on what the embedding page has access to (cookies, session tokens, DOM), per standard reflected/stored XSS.

### Patch

Both formatters now run their interpolated input through the browser's text-node escaping (`createElement` + `textContent`) before producing the HTML string. Fixed in version `2.0.1`.

Patch / fix

  • npm devbridge-autocomplete 2.0.1

Is GHSA-hvqh-jw65-wcpq in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
GitHub 3.1 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm devbridge-autocomplete
<2.0.1
2.0.1

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.