cve.bz

CVE-2014-0014

5.4 mediumEPSS 1.2%

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application using the "{{group}}" Helper and a crafted payload.

Severity

CVSS 3.0

5.4 medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-rcx6-7jp6-pqf2RubyGemsember-source>=1.0.0.pre4.0 <1.0.11.0.1
GHSA-rcx6-7jp6-pqf2RubyGemsember-source>=1.1.0 <1.1.31.1.3
GHSA-rcx6-7jp6-pqf2RubyGemsember-source>=1.2.0.beta.1 <1.2.11.2.1
GHSA-rcx6-7jp6-pqf2RubyGemsember-source>=1.3.0.beta.1 <1.3.11.3.1
GHSA-rcx6-7jp6-pqf2RubyGemsember-source>=1.4.0-beta.1 <1.4.0-beta.21.4.0-beta.2

References

Check your stackJSON