icefox0801
JS injection
The autocomplete data isn't escaped for being presented in HTML. For example try using '<script>alert("hello")</script>' as the text of an item, and you'll see an alert pop up when showing that item in the autocomplete.
This is kind of a big security hole in the component...
Oh, actually, one has to escape it in the itemTemplate... sorry about the issue!
Reopening. I thought underscore or lodash was being used for templates, but it seems the logic is reimplemented here. The problem is, the < and > characters are not being escaped. So yes, this is a security issue...
As a workaround, in templates you can do:
<%= $("<div/>").text(item.text).html() %>
This uses a trick to escape HTML using jquery (which should be available because materialize needs it)