{"id":"CVE-2015-7565","aliases":["CLSA-2026-1780447820","EUVD-2018-0409","GHSA-m3q7-rj8g-m457"],"status":"published","title":"ember-source Cross-site Scripting vulnerability","description":"Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00816,"percentile":0.57357,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2017-04-13T14:00:00Z","modified":"2026-10-15T09:48:03Z","fixes":[{"ecosystem":"RubyGems","package":"ember-source","fixed_in":["1.11.4","1.12.2","1.13.12","2.0.3","2.1.2","2.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"ember-cli","fixed_in":["1.13.11-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.11.4"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.13.12"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"last_affected":"2.2.0"},{"fixed":"2.2.1"}]}],"versions":["2.2.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"ember-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.11-tuxcare.0"},{"fixed":"1.13.11-tuxcare.1"}]}],"versions":["1.13.11"]},{"source":"osv","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.11.4"}]}],"versions":["1.10.0","1.10.0.beta.1","1.10.0.beta.2","1.10.0.beta.3","1.10.0.beta.4","1.10.1","1.11.0","1.11.0.1","1.11.0.beta.1","1.11.0.beta.2","1.11.0.beta.2.1","1.11.0.beta.2.2","1.11.0.beta.3","1.11.0.beta.4","1.11.0.beta.5","1.11.1","1.11.3","1.11.3.1","1.8.0","1.8.1","1.9.0","1.9.0.alpha","1.9.0.alpha.2","1.9.0.beta.1","1.9.0.beta.1.1","1.9.0.beta.3","1.9.0.beta.4","1.9.1"]},{"source":"osv","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.12.0"},{"fixed":"1.12.2"}]}],"versions":["1.12.0","1.12.1"]},{"source":"osv","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.13.0"},{"fixed":"1.13.12"}]}],"versions":["1.13.0","1.13.1","1.13.1.1","1.13.10","1.13.11","1.13.2","1.13.3","1.13.4","1.13.4.1","1.13.5","1.13.6","1.13.7","1.13.8","1.13.9"]},{"source":"osv","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.3"}]}],"versions":["2.0.0","2.0.2"]},{"source":"osv","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}]}],"versions":["2.1.0"]},{"source":"osv","ecosystem":"RubyGems","package":"ember-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.1"}]}],"versions":["2.2.0"]}],"products":[{"vendor":"emberjs","product":"ember.js"}],"references":[{"url":"http://emberjs.com/blog/2016/01/14/security-releases-ember-1-11-4-1-12-2-1-13-12-2-0-3-2-1-2-2-2-1.html","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://groups.google.com/forum/#%21topic/ember-security/OfyQkoSuppY","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7565","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/ember-security/OfyQkoSuppY","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ember-source/CVE-2015-7565.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m3q7-rj8g-m457"}],"sources":{"cve":[{"id":"CVE-2015-7565","description":"Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.","status":"published","published":"2017-04-13T14:00:00Z","modified":"2024-08-06T07:51:28.532Z","updated_at":"2026-11-02T14:35:44.404481Z"}],"euvd":[{"id":"EUVD-2018-0409","description":"Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.","status":"published","published":"2017-04-13T14:00:00Z","modified":"2024-08-06T07:51:28Z","updated_at":"2026-11-03T02:21:52.097705Z"}],"ghsa":[{"id":"GHSA-m3q7-rj8g-m457","title":"ember-source Cross-site Scripting vulnerability","description":"Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.","status":"published","published":"2018-08-28T22:33:24Z","modified":"2023-08-29T11:39:46Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:01.345964Z"}],"nvd":[{"id":"CVE-2015-7565","description":"Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.","status":"published","published":"2017-04-13T14:59:00.84Z","modified":"2026-06-17T00:32:45.697Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:17.368799Z"}],"osv":[{"id":"GHSA-m3q7-rj8g-m457","title":"ember-source Cross-site Scripting vulnerability","description":"Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12, 2.0.x before 2.0.3, 2.1.x before 2.1.2, and 2.2.x before 2.2.1 allows remote attackers to inject arbitrary web script or HTML.","status":"published","published":"2018-08-28T22:33:24Z","modified":"2024-02-16T08:06:35.628087Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"CLSA-2026-1780447820","title":"TuxCare security update for ember-cli (1 CVE)","description":"TuxCare rebuilt ember-cli to address 1 CVE. Fixed in 1.13.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-10-15T09:48:03.604414612Z","updated_at":"2026-11-02T15:43:45.445699Z"}]}}