Cross-site Scripting (XSS) Affecting backbone package, versions <0.1.2


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.05% (21st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Cross-site Scripting (XSS) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDnpm:backbone:20160523
  • published22 Jun 2016
  • disclosed23 May 2016
  • creditUnknown

Introduced: 23 May 2016

CVE-2016-10537  (opens in a new tab)
CWE-79  (opens in a new tab)

How to fix?

Upgrade to version 0.5.0 or higher.

Overview

backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON

backbone is the npm package for Backbone.js, which uses key-value binding and custom events to connects existing API over a RESTful JSON interface.

Backbone has a security control in its Escape function, which performs HTML encoding. However, the regex is incomplete, notably not properly handling cases such as HTML entities (e.g. not treating &#60 as <). HTML Entities are often overlooked by HTML Encoding security controls, you can read more detail about a similar one in the Marked package

This exposes a Cross-site Scripting (XSS) vulnerability if users can influence the input provided.

Details

<>

CVSS Scores

version 3.1