In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However,…

Description

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.

Scores

EPSS (exploitation in 30 days)

0.94% · top 39% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.

Weakness

• CWE-79 (opens in a new tab)All about CWE-79 and its CVEs

Affected products

• ember-source

  • affected ember-source < 1.0.0.rc1.1

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• RubyGemsember-sourceGHSA-5m48-c37x-f792 (opens in a new tab)

References (3)

• https://rubysec.com/advisories/CVE-2013-4170/ (opens in a new tab)x_refsource_MISCx_transferred
• https://security.snyk.io/vuln/SNYK-RUBY-EMBERSOURCE-20102 (opens in a new tab)x_refsource_MISCx_transferred
• https://groups.google.com/g/ember-security/c/dokLVwwxAdM (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-5m48-c37x-f792 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2013-4170](https://trackcve.app/badge/CVE-2013-4170.svg)](https://trackcve.app/cve/CVE-2013-4170)

Record last updated 6 Aug 2024, 16:38 UTC.