{"id":"CVE-2016-10537","aliases":["DEBIAN-CVE-2016-10537","EUVD-2019-0308","GHSA-j6p2-cx3w-6jcp"],"status":"published","title":"Cross-Site Scripting in backbone","description":"backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as `\u003c` to `\u003c`.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00675,"percentile":0.52453,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2018-05-31T20:00:00Z","modified":"2026-10-20T10:47:25Z","fixes":[{"ecosystem":"npm","package":"backbone","fixed_in":["0.5.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"backbone","fixed_in":["0.5.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"backbone","fixed_in":["0.5.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"backbone","fixed_in":["0.5.3-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"backbone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.3.3"},{"fixed":"0.5.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"backbone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"backbone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"backbone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-1"}]}]},{"source":"osv","ecosystem":"npm","package":"backbone","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.3"},{"fixed":"0.5.0"}]}]}],"products":[{"vendor":"backbone_project","product":"backbone"},{"vendor":"hackerone","product":"backbone node module"}],"references":[{"url":"https://nodesecurity.io/advisories/108","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/jashkenas/backbone/compare/0.3.3...0.5.0#diff-0d56d0d310de7ff18b3cef9c2f8f75dcL1008","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10537","tags":["advisory"]},{"url":"https://github.com/jashkenas/backbone/commit/0cdc525961d3fa98e810ffae6bcc8e3838e36d93","tags":["web"]},{"url":"https://backbonejs.org/#changelog","tags":["web"]},{"url":"https://github.com/jashkenas/backbone/commit/7ae0384120c2552e1c426cda7fb02fdce6ef1076","tags":["web"]},{"url":"https://github.com/jashkenas/backbone/blame/0cdc525961d3fa98e810ffae6bcc8e3838e36d93/backbone.js","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j6p2-cx3w-6jcp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-10537","tags":["advisory"]},{"url":"https://github.com/jashkenas/backbone","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2016-10537","description":"backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as `\u003c` to `\u003c`.","status":"published","published":"2018-05-31T20:00:00Z","modified":"2024-09-17T04:14:50.404Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:31.117878Z"}],"euvd":[{"id":"EUVD-2019-0308","description":"backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as `\u003c` to `\u003c`.","status":"published","published":"2018-05-31T20:00:00Z","modified":"2024-09-17T04:14:50Z","updated_at":"2026-11-03T00:28:24.323088Z"}],"ghsa":[{"id":"GHSA-j6p2-cx3w-6jcp","title":"Cross-Site Scripting in backbone","description":"Affected versions of `backbone` are vulnerable to cross-site scripting when users are allowed to supply input to the `Model#Escape` function, and the output is then written to the DOM. \n\nThe vulnerability occurs as a result of the regular expression used to encode metacharacters failing to take HTML Entities such as `\u0026#60;` into account.\n\n\n## Recommendation\n\nUpdate to version 0.5.0 or later.","status":"published","published":"2019-02-18T23:39:55Z","modified":"2026-01-16T22:08:37Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:18.564331Z"}],"nvd":[{"id":"CVE-2016-10537","description":"backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as `\u003c` to `\u003c`.","status":"published","published":"2018-05-31T20:29:01.317Z","modified":"2026-06-17T00:39:53.9Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:39.176887Z"}],"osv":[{"id":"CVE-2016-10537","description":"backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as `\u003c` to `\u003c`.","status":"published","published":"2018-05-31T20:29:01.317Z","modified":"2026-10-20T10:47:25.194634223Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"DEBIAN-CVE-2016-10537","description":"backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as `\u003c` to `\u003c`.","status":"published","published":"2018-05-31T20:29:01.317Z","modified":"2026-09-22T07:01:22.681466319Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"GHSA-j6p2-cx3w-6jcp","title":"Cross-Site Scripting in backbone","description":"Affected versions of `backbone` are vulnerable to cross-site scripting when users are allowed to supply input to the `Model#Escape` function, and the output is then written to the DOM. \n\nThe vulnerability occurs as a result of the regular expression used to encode metacharacters failing to take HTML Entities such as `\u0026#60;` into account.\n\n\n## Recommendation\n\nUpdate to version 0.5.0 or later.","status":"published","published":"2019-02-18T23:39:55Z","modified":"2026-02-03T03:07:13.937421Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:49.977351Z"}]}}