GHSA-HVQH-JW65-WCPQ: Cross-Site Scripting (XSS) in devbridge-autocomplete

Vulnerability ID: GHSA-HVQH-JW65-WCPQ
CVSS Score: 6.1
Published: 2026-06-22

The devbridge-autocomplete package (jQuery-Autocomplete) fails to escape category headers and suggestion values when using default formatters formatGroup and formatResult. If suggestions contain untrusted input, arbitrary HTML and JavaScript execute directly in the victim's browser session.

TL;DR

Unescaped HTML in autocomplete suggestion categories or values can bypass client-side rendering filters and execute arbitrary JavaScript.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-79
Attack Vector: Network
CVSS v3.1 Score: 6.1 (Medium)
Exploit Status: PoC (Proof-of-Concept)
KEV Status: Not Listed
Impact: Client-side Script Execution (Cross-Site Scripting)

Affected Systems

devbridge-autocomplete (NPM package)
jQuery-Autocomplete (GitHub repository)
devbridge-autocomplete: < 2.0.1 (Fixed in: 2.0.1)

Code Analysis

Commit: 63ff096

Fix XSS vulnerabilities by using native DOM element creation and textContent to securely escape categories and suggestion values.

Exploit Details

GitHub Advisory Database: Proof of concept and mitigation patterns detailed in the primary advisory context.

Mitigation Strategies

Upgrade devbridge-autocomplete to version 2.0.1 or higher.
Override default formatResult and formatGroup functions during initialization with secure DOM serialization handlers.
Enforce a Content Security Policy (CSP) that restricts inline script execution.

Remediation Steps:

Open the project package.json file and identify the devbridge-autocomplete dependency.
Update the version identifier to ^2.0.1.
Run npm install or yarn install to apply the change.
For non-package-managed deployments, download the patched version of jquery.autocomplete.js directly from the official repository and replace the existing legacy library.
Test custom input fields with test scripts () to verify successful neutralization.