Publish GHSA-hvqh-jw65-wcpq

advisory-database[bot] · advisory-database[bot] · commit 49d4c1802a4c · 2026-06-22T23:03:11.000Z
diff --git a/advisories/github-reviewed/2026/06/GHSA-hvqh-jw65-wcpq/GHSA-hvqh-jw65-wcpq.json b/advisories/github-reviewed/2026/06/GHSA-hvqh-jw65-wcpq/GHSA-hvqh-jw65-wcpq.json
@@ -0,0 +1,62 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hvqh-jw65-wcpq",
+  "modified": "2026-06-22T23:00:50Z",
+  "published": "2026-06-22T23:00:50Z",
+  "aliases": [],
+  "summary": "devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs",
+  "details": "### Summary\n\nThe default `formatGroup` and `formatResult` functions in `devbridge-autocomplete` concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion data source.\n\n### Details\n\n**1. `formatGroup` — `category` is interpolated raw.**\n\n`src/format.ts`:\n\n```ts\nfunction formatGroup(suggestion, category) {\n    return '<div class=\"autocomplete-group\">' + category + '</div>';\n}\n```\n\nIf `groupBy` is used and the grouping field of any suggestion contains HTML, that HTML is executed.\n\n**2. `formatResult` — early-return branch returns `suggestion.value` raw.**\n\n`src/format.ts`:\n\n```ts\nfunction formatResult(suggestion, currentValue) {\n    if (!currentValue) {\n        return suggestion.value;   // un-escaped\n    }\n    /* ... non-empty path escapes correctly ... */\n}\n```\n\nThe early-return branch is reached when `suggest()` renders with an empty `currentValue`, which happens with `minChars: 0` and a server that returns suggestions for an empty query. The returned string is concatenated into the container's `innerHTML`.\n\n### PoC (formatGroup)\n\n```html\n<!DOCTYPE html>\n<html>\n<head>\n    <meta charset=\"utf-8\">\n    <title>PoC: formatGroup XSS in jQuery-Autocomplete v2.0.0</title>\n</head>\n<body>\n    <input id=\"ac\" type=\"text\" placeholder=\"Type 'a' to trigger\" autocomplete=\"off\">\n\n    <script src=\"https://code.jquery.com/jquery-3.7.1.min.js\"></script>\n    <script src=\"dist/jquery.autocomplete.js\"></script>\n    <script>\n        var poisoned = [\n            { value: 'Apple',   data: { category: \"<img src=x onerror=\\\"alert('XSS via formatGroup')\\\">\" } },\n            { value: 'Avocado', data: { category: 'Safe Group' } }\n        ];\n\n        $('#ac').devbridgeAutocomplete({\n            lookup: poisoned,\n            groupBy: 'category',\n            minChars: 1\n        });\n    </script>\n</body>\n</html>\n```\n\nOriginally identified by an earlier human analysis; the PoC above was produced with the assistance of Claude Opus 4.7.\n\n### Impact\n\nXSS in pages that render attacker-controllable suggestion data. The actual impact depends on what the embedding page has access to (cookies, session tokens, DOM), per standard reflected/stored XSS.\n\n### Patch\n\nBoth formatters now run their interpolated input through the browser's text-node escaping (`createElement` + `textContent`) before producing the HTML string. Fixed in version `2.0.1`.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "devbridge-autocomplete"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.0.1"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 2.0.0"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/devbridge/jQuery-Autocomplete/security/advisories/GHSA-hvqh-jw65-wcpq"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/devbridge/jQuery-Autocomplete/commit/63ff096ff5b77a90aac7fb5dad7c86e538a59ce0"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/devbridge/jQuery-Autocomplete"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-06-22T23:00:50Z",
+    "nvd_published_at": null
+  }
+}
