devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs
### Summary The default `formatGroup` and `formatResult` functions in `devbridge-autocomplete` concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion data source. ### Details **1. `formatGroup` — `category` is interpolated raw.** `src/format.ts`: ```ts function formatGroup(suggestion, category) { return '<div class="autocomplete-group">' + category + '</div>'; } ``` If `groupBy` is used and the grouping field of any suggestion contains HTML, that HTML is executed. **2. `formatResult` — early-return branch returns `suggestion.value` raw.** `src/format.ts`: ```ts function
- Update to 2.0.1
Published Updated