CVE-2014-0014

ember-source Cross-site Scripting vulnerability

5.4 MediumFix available

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application using the "{{group}}" Helper and a crafted payload.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

1.20%Up 0.1 points since Feb 4, 2022

What each source reports

NVD Score used 5.4

Record: CVE-2014-0014
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-0014
Updated: 2026-11-02

EUVDEUVD-2022-5153 No score

Record: EUVD-2022-5153
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rcx6-7jp6-pqf2 5.4

ember-source Cross-site Scripting vulnerability

Record: GHSA-rcx6-7jp6-pqf2
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-rcx6-7jp6-pqf2 5.4

ember-source Cross-site Scripting vulnerability

Record: GHSA-rcx6-7jp6-pqf2
CVSS 3.0: 5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

emberjs ember.js

Affected packages

Affected packages
Package	Affected	Fixed
`ember-source` RubyGems	1.0.0.pre4.0 up to 1.0.1	1.0.1
`ember-source` RubyGems	1.1.0 up to 1.1.3	1.1.3
`ember-source` RubyGems	1.2.0.beta.1 up to 1.2.1	1.2.1
`ember-source` RubyGems	1.3.0.beta.1 up to 1.3.1	1.3.1
`ember-source` RubyGems	1.4.0-beta.1 to 1.4.0-beta.1	1.4.0-beta.2
`ember-source` RubyGems	1.0.0.pre4.0 up to 1.0.1, plus listed versions 1.0.01.0.0.pre4.11.0.0.pre4.21.0.0.rc1.0.01.0.0.rc1.1 Show 22 moreShow less 1.0.0.rc1.21.0.0.rc1.31.0.0.rc1.41.0.0.rc2.01.0.0.rc2.11.0.0.rc2.21.0.0.rc2.31.0.0.rc31.0.0.rc3.11.0.0.rc3.21.0.0.rc3.31.0.0.rc3.41.0.0.rc3.51.0.0.rc41.0.0.rc4.11.0.0.rc51.0.0.rc5.11.0.0.rc61.0.0.rc6.21.0.0.rc6.41.0.0.rc71.0.0.rc8	1.0.1
`ember-source` RubyGems	1.1.0 up to 1.1.3, plus listed versions 1.1.11.1.2	1.1.3
`ember-source` RubyGems	1.2.0.beta.1 up to 1.2.1, plus listed versions 1.2.01.2.0.11.2.0.beta.21.2.0.beta.31.2.0.beta.4	1.2.1
`ember-source` RubyGems	1.3.0.beta.1 up to 1.3.1, plus listed versions 1.3.01.3.0.beta.21.3.0.beta.31.3.0.beta.4	1.3.1
`ember-source` RubyGems	1.4.0-beta.1 up to 1.4.0-beta.2	1.4.0-beta.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0014 is a medium vulnerability (CVSS 5.4) in Emberjs Ember.js, published February 15, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.20%, the 68th percentile. Fixed in ember-source 1.0.1.