Search for packages
| purl | pkg:gem/ember-source@1.1.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-78w7-adb5-qfga
Aliases: CVE-2014-0013 |
Potential XSS Exploit With User-Supplied Data When Binding In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, we have identified a vulnerability that could lead to unescaped content being inserted into the innerHTML string without being sanitized. When a primitive value is used as the Handlebars context, that value is not properly escaped. An example of this would be using the `{{each}}` helper to iterate over an array of user-supplied strings and using `{{this}}` inside the block to display each string. In applications that contain templates whose context is a primitive value and use the `{{this}}` keyword to display that value, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability affects applications that contain templates whose context is set to a user-supplied primitive value (such as a string or number) and also contain the `{{this}}` special Handlebars variable to display the value. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-02T04:37:31.759821+00:00 | GitLab Importer | Affected by | VCID-78w7-adb5-qfga | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/ember-source/CVE-2014-0013.yml | 38.6.0 |