{"id":"CVE-2013-4170","aliases":["EUVD-2022-6246","GHSA-5m48-c37x-f792"],"status":"published","title":"Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data","description":"In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain (\"XSS\"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00942,"percentile":0.61231,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-06-30T12:38:42Z","modified":"2026-09-10T03:49:55Z","fixes":[{"ecosystem":"RubyGems","package":"ember-source","fixed_in":["1.0.0.rc1.1","1.0.0.rc2.1","1.0.0.rc3.1","1.0.0.rc4.1","1.0.0.rc5.1","1.0.0.rc6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.0.rc1.0"},{"fixed":"1.0.0.rc1.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0.rc2.0"},{"last_affected":"1.0.0.rc2.0"},{"fixed":"1.0.0.rc2.1"}]}],"versions":["1.0.0.rc2.0"]},{"source":"ghsa","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0.rc3.0"},{"last_affected":"1.0.0.rc3.0"},{"fixed":"1.0.0.rc3.1"}]}],"versions":["1.0.0.rc3.0"]},{"source":"ghsa","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0.rc4.0"},{"last_affected":"1.0.0.rc4.0"},{"fixed":"1.0.0.rc4.1"}]}],"versions":["1.0.0.rc4.0"]},{"source":"ghsa","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0.rc5.0"},{"last_affected":"1.0.0.rc5.0"},{"fixed":"1.0.0.rc5.1"}]}],"versions":["1.0.0.rc5.0"]},{"source":"ghsa","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0.rc6.0"},{"last_affected":"1.0.0.rc6.0"},{"fixed":"1.0.0.rc6.1"}]}],"versions":["1.0.0.rc6.0"]},{"source":"osv","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0.rc1.1"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","1.0.0.pre4.0","1.0.0.pre4.1","1.0.0.pre4.2","1.0.0.rc1.0.0"]},{"source":"osv","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0.rc2.0"},{"fixed":"1.0.0.rc2.1"}]}],"versions":["1.0.0.rc2.0"]},{"source":"osv","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0.rc3.0"},{"fixed":"1.0.0.rc3.1"}]}],"versions":["1.0.0.rc3","1.0.0.rc3.0"]},{"source":"osv","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0.rc4.0"},{"fixed":"1.0.0.rc4.1"}]}],"versions":["1.0.0.rc4","1.0.0.rc4.0"]},{"source":"osv","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0.rc5.0"},{"fixed":"1.0.0.rc5.1"}]}],"versions":["1.0.0.rc5","1.0.0.rc5.0"]},{"source":"osv","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0.rc6.0"},{"fixed":"1.0.0.rc6.1"}]}],"versions":["1.0.0.rc6","1.0.0.rc6.0"]}],"products":[{"vendor":"emberjs","product":"ember.js"}],"references":[{"url":"https://rubysec.com/advisories/CVE-2013-4170/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-RUBY-EMBERSOURCE-20102","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://groups.google.com/g/ember-security/c/dokLVwwxAdM","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4170","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ember-source/CVE-2013-4170.yml","tags":["web"]},{"url":"https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5m48-c37x-f792"},{"url":"https://github.com/emberjs/ember.js","tags":["package"]},{"url":"https://rubysec.com/advisories/CVE-2013-4170","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4170","description":"In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain (\"XSS\"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.","status":"published","published":"2022-06-30T12:38:42Z","modified":"2024-08-06T16:38:01.461Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2022-6246","description":"In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain (\"XSS\"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.","status":"published","published":"2022-06-30T12:38:42Z","modified":"2024-08-06T16:38:01Z","updated_at":"2026-11-03T01:56:32.187151Z"}],"ghsa":[{"id":"GHSA-5m48-c37x-f792","title":"Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data","description":"In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain (\"XSS\"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.","status":"published","published":"2022-07-01T00:01:11Z","modified":"2023-08-29T11:06:47Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:01.345964Z"}],"nvd":[{"id":"CVE-2013-4170","description":"In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain (\"XSS\"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.","status":"published","published":"2022-06-30T13:15:08.23Z","modified":"2026-06-16T23:56:45.033Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.6,"vector":"AV:N/AC:H/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:52.934105Z"}],"osv":[{"id":"GHSA-5m48-c37x-f792","title":"Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data","description":"In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain (\"XSS\"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.","status":"published","published":"2022-07-01T00:01:11Z","modified":"2026-09-10T03:49:55.212583306Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:38.553953Z"}]}}