CVE-2014-0046

ember-source Cross-site Scripting vulnerability

2.6 LowFix available

CVE-2014-0046 is a low vulnerability (CVSS 2.6) in Emberjs Ember.js, published February 27, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in ember-source 1.2.2.

Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.

Exploit likelihood

1.50%Up 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 2.6

Record: CVE-2014-0046
CVSS 2.0: 2.6 LowAV:N/AC:H/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-0046
Updated: 2026-11-02

EUVDEUVD-2018-0366 No score

Record: EUVD-2018-0366
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4q53-fqhc-cr46 No score

ember-source Cross-site Scripting vulnerability

Record: GHSA-4q53-fqhc-cr46
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-4q53-fqhc-cr46 No score

ember-source Cross-site Scripting vulnerability

Record: GHSA-4q53-fqhc-cr46
Weakness: CWE-79
Updated: 2026-11-02

Affected products

emberjs ember.js

Affected packages

Affected packages
Package	Affected	Fixed
`ember-source` RubyGems	1.2.0 up to 1.2.2	1.2.2
`ember-source` RubyGems	1.3.0 up to 1.3.2	1.3.2
`ember-source` RubyGems	1.4.0.beta.1 up to 1.4.0.beta.6	1.4.0.beta.6
`ember-source` RubyGems	1.2.0 up to 1.2.2, plus listed versions 1.2.0.11.2.1.1	1.2.2
`ember-source` RubyGems	1.3.0 up to 1.3.2, plus listed versions 1.3.1.1	1.3.2
`ember-source` RubyGems	1.4.0.beta.1 up to 1.4.0.beta.6, plus listed versions 1.4.0.beta.21.4.0.beta.31.4.0.beta.41.4.0.beta.5	1.4.0.beta.6

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 7 moreShow less