Cross-site Scripting (XSS) Affecting ember-source package, versions >=1.4.0.beta.1, <1.4.0.beta.2>=1.3.0, <1.3.1>=1.2.0, <1.2.1>=1.1.0, <1.1.3<1.0.1
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Cross-site Scripting (XSS) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-RUBY-EMBERSOURCE-20139
- published13 Jan 2014
- disclosed13 Jan 2014
- creditTom Dale
Introduced: 13 Jan 2014
CVE-2014-0013 (opens in a new tab)Overview
ember is an Ember.js source code wrapper for use with Ruby libs.
Affected versions of this gem allow an attacker to execute a Cross-site Scripting (XSS) attack.
In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. Affected versions of this gem contain a vulnerability that could lead to unescaped content being inserted into the innerHTML string without being sanitized.
When a primitive value is used as the Handlebars context, that value is not properly escaped. An example of this would be using the {{each}} helper to iterate over an array of user-supplied strings and using {{this}} inside the block to display each string.
In applications that contain templates whose context is a primitive value and use the {{this}} keyword to display that value, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS").
This vulnerability affects applications that contain templates whose context is set to a user-supplied primitive value (such as a string or number) and also contain the {{this}} special Handlebars variable to display the value.
Details
<>