Autocomplete strips html like suggestions

[FINDarkside]

At the moment autocomplete component strips html like elements form the suggestions. If you run this in the home page:

  $(document).ready(function(){
    $('input.autocomplete').autocomplete({
      data: {
        "<div>apple</div>": null,
      },
    });
  });

I'd expect the autocomplete to match "<div" and so on, but it will only render "apple". It does not create the div element, so it's not XSS issue, but for some reason the component only renders "apple" even though it should render "<div>apple</div>"

[FINDarkside]

Actually there is XSS vulnerability,. #6286