Skip to content
OpenAdvisories

Package · npm

devbridge-autocomplete

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • Medium 5.4
    GHSA-hvqh-jw65-wcpq

    devbridge-autocomplete has XSS in its default formatters: formatGroup and formatResult fail to escape HTML in untrusted inputs

    ### Summary The default `formatGroup` and `formatResult` functions in `devbridge-autocomplete` concatenate values into HTML without escaping, allowing XSS when an attacker controls (or can taint) the suggestion data source. ### Details **1. `formatGroup` — `c…

    devbridge-autocomplete npm