Cross-site Scripting (XSS)

Overview org.webjars.npm:devbridge-autocomplete is an Autocomplete provides suggestions while you type into the text field. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the formatGroup and formatResult functions. An attacker can inject and execute arbitrary HTM...

Cross-site Scripting (XSS)

Overview devbridge-autocomplete is an Autocomplete provides suggestions while you type into the text field. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the formatGroup and formatResult functions. An attacker can inject and execute arbitrary HTML or JavaScript...

GHSA-HVQH-JW65-WCPQ devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs

Summary The default formatGroup and formatResult functions in devbridge-autocomplete concatenate values into HTML without escaping, allowing XSS when an attacker controls or can taint the suggestion data source. Details 1. formatGroup — category is interpolated raw. src/format.ts: ts function...

PT-2026-55397

Summary The default formatGroup and formatResult functions in devbridge-autocomplete concatenate values into HTML without escaping, allowing XSS when an attacker controls or can taint the suggestion data source. Details 1. formatGroup — category is interpolated raw. src/format.ts: ts function...