CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2013-4170
In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 61% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- emberjs:ember.js
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-5m48-c37x-f792 | RubyGems | ember-source | <1.0.0.rc1.1 | 1.0.0.rc1.1 |
| GHSA-5m48-c37x-f792 | RubyGems | ember-source | >=1.0.0.rc2.0 <1.0.0.rc2.1 | 1.0.0.rc2.1 |
| GHSA-5m48-c37x-f792 | RubyGems | ember-source | >=1.0.0.rc3.0 <1.0.0.rc3.1 | 1.0.0.rc3.1 |
| GHSA-5m48-c37x-f792 | RubyGems | ember-source | >=1.0.0.rc4.0 <1.0.0.rc4.1 | 1.0.0.rc4.1 |
| GHSA-5m48-c37x-f792 | RubyGems | ember-source | >=1.0.0.rc5.0 <1.0.0.rc5.1 | 1.0.0.rc5.1 |
| GHSA-5m48-c37x-f792 | RubyGems | ember-source | >=1.0.0.rc6.0 <1.0.0.rc6.1 | 1.0.0.rc6.1 |