XSS Vulnerability in VirtualSelect’s options Configuration

[izambasiron]

Description:
When using the VirtualSelect library with user-controlled options values, certain JavaScript event handlers embedded within the label or value fields are executed, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This issue occurs even with the enableSecureText option enabled, suggesting that it does not fully sanitize or escape inputs with JavaScript embedded.

Codepen demo

Steps to Reproduce:

1. Initialize VirtualSelect with an option containing a JavaScript onclick event in the label and value fields.

   document.addEventListener('DOMContentLoaded', function () {
     VirtualSelect.init({
       ele: '#sample-select',
       showValueAsTags: true,
       enableSecureText: true,
       options: [
         { label: '" onclick="alert(\'label\')"', value: '" onclick="alert(\'value\')"' }
       ],
     });
   });

2. Load the page containing this code.

3. Observe that clicking on the injected option label triggers an alert dialog due to the embedded onclick event.

Expected Behavior:
The enableSecureText option should escape or sanitize any potentially harmful JavaScript, ensuring that user-provided content in label and value fields cannot trigger XSS.

Actual Behavior:
JavaScript code embedded within value fields is executed, leading to a potential XSS vulnerability.

Environment:

• VirtualSelect version: 1.0.46
• Browser: Chrome, Safari, Firefox
• Operating System: Windows, MacOS, Android, iOS