Every CVE Search/ Get API key

CVE-2013-4170

Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data

6.1 MediumFix available

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the tagName property of an Ember.View was inserted into such a string without being sanitized. This means that if an application assigns a view's tagName to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to tagName.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.94%Up 0.1 points since Jul 1, 2022
90%50%10%1%

What each source reports

NVD Score used 6.1

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the tagName property of an Ember.View was inserted into such a string without being sanitized. This means that if an application assigns a view's tagName to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to tagName.

Record
CVE-2013-4170
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
2.6 LowAV:N/AC:H/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the tagName property of an Ember.View was inserted into such a string without being sanitized. This means that if an application assigns a view's tagName to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to tagName.

Record
CVE-2013-4170
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2022-6246 No score

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the tagName property of an Ember.View was inserted into such a string without being sanitized. This means that if an application assigns a view's tagName to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to tagName.

Record
EUVD-2022-6246
Updated
2026-11-03
GitHub AdvisoriesGHSA-5m48-c37x-f792 6.1

Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the tagName property of an Ember.View was inserted into such a string without being sanitized. This means that if an application assigns a view's tagName to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to tagName.

Record
GHSA-5m48-c37x-f792
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-5m48-c37x-f792 6.1

Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the tagName property of an Ember.View was inserted into such a string without being sanitized. This means that if an application assigns a view's tagName to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to tagName.

Record
GHSA-5m48-c37x-f792
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ember-source
RubyGems
 through 1.0.0.rc1.0
1.0.0.rc1.1
ember-source
RubyGems
 1.0.0.rc2.0 to 1.0.0.rc2.0
1.0.0.rc2.1
ember-source
RubyGems
 1.0.0.rc3.0 to 1.0.0.rc3.0
1.0.0.rc3.1
ember-source
RubyGems
 1.0.0.rc4.0 to 1.0.0.rc4.0
1.0.0.rc4.1
ember-source
RubyGems
 1.0.0.rc5.0 to 1.0.0.rc5.0
1.0.0.rc5.1
ember-source
RubyGems
 1.0.0.rc6.0 to 1.0.0.rc6.0
1.0.0.rc6.1
ember-source
RubyGems
 before 1.0.0.rc1.1, plus listed versions
0.0.10.0.20.0.30.0.40.0.5
Show 8 moreShow less
0.0.60.0.70.0.80.0.91.0.0.pre4.01.0.0.pre4.11.0.0.pre4.21.0.0.rc1.0.0
1.0.0.rc1.1
ember-source
RubyGems
 1.0.0.rc2.0 up to 1.0.0.rc2.1
1.0.0.rc2.1
ember-source
RubyGems
 1.0.0.rc3.0 up to 1.0.0.rc3.1, plus listed versions
1.0.0.rc3
1.0.0.rc3.1
ember-source
RubyGems
 1.0.0.rc4.0 up to 1.0.0.rc4.1, plus listed versions
1.0.0.rc4
1.0.0.rc4.1
ember-source
RubyGems
 1.0.0.rc5.0 up to 1.0.0.rc5.1, plus listed versions
1.0.0.rc5
1.0.0.rc5.1
ember-source
RubyGems
 1.0.0.rc6.0 up to 1.0.0.rc6.1, plus listed versions
1.0.0.rc6
1.0.0.rc6.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4170 is a medium vulnerability (CVSS 6.1) in Emberjs Ember.js, published June 30, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.94%, the 61st percentile. Fixed in ember-source 1.0.0.rc1.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open