Description
The default formatGroup and formatResult functions in devbridge-autocomplete concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion data source.
Recommendation
Update the devbridge-autocomplete package to the latest compatible version. Followings are version details:
- Affected version(s): <= 2.0.0
- Patched version(s): 2.0.1
References
Could your website be exposed too?
SmartScanner can check your website for devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` - CVE-2026-44990
- Trix has a stored XSS vulnerability through its attachment attribute - Vulnerability
- Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
- MCPHub has an Improper Authorization vulnerability via its handleSseConnection function - CVE-2025-11287
You might also like:
See something that needs correcting? Let us knowUpdated June 22, 2026