Search for packages
| purl | pkg:gem/ember-source@1.12.0a |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-a5hm-euty-z7g1
Aliases: CVE-2015-7565 |
XSS Vulnerability with User-Supplied JSON By default, Ember will escape any values in Handlebars templates that use double curlies (`{{value}}`). Developers can specifically opt out of this escaping behavior by passing an instance of `SafeString` rather than a raw string, which tells Ember that it should not escape the string because the developer has taken responsibility for escapement. It is possible for an attacker to create a specially-crafted payload that causes a non-sanitized string to be treated as a `SafeString`, and thus bypass Ember's normal escaping behavior. This could allow an attacker to execute arbitrary JavaScript in the context of the current domain ("XSS"). |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-eafw-zr9e-ryfu
Aliases: CVE-2015-1866 |
Vulnerability With {{view "select"}} Options In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, a change made to the implementation of the select view means that any user-supplied data bound to an option's label will not be escaped correctly. In applications that use Ember's select view and pass user-supplied content to the label, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-02T04:37:05.988720+00:00 | GitLab Importer | Affected by | VCID-eafw-zr9e-ryfu | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/ember-source/CVE-2015-1866.yml | 38.6.0 |
| 2026-06-02T04:36:50.623285+00:00 | GitLab Importer | Affected by | VCID-a5hm-euty-z7g1 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/ember-source/CVE-2015-7565.yml | 38.6.0 |