devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted

Description

The default formatGroup and formatResult functions in devbridge-autocomplete concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion data source.

Recommendation

Update the devbridge-autocomplete package to the latest compatible version. Followings are version details:

• Affected version(s): <= 2.0.0
• Patched version(s): 2.0.1

References

• GHSA-hvqh-jw65-wcpq
• CWE-79
• OWASP 2021-A3

Related Issues

• Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` - CVE-2026-44990
• Trix has a stored XSS vulnerability through its attachment attribute - Vulnerability
• Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering - CVE-2025-54075
• MCPHub has an Improper Authorization vulnerability via its handleSseConnection function - CVE-2025-11287

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

These 7 PHP mistakes leave your website open to the hackers

How do hackers hack websites?

Tags:

npm

devbridge-autocomplete