VulnerableCode Package Details - pkg:gem/ember-source@1.3.1.1

Search for packages

Vulnerability	Summary	Fixed by
VCID-42k5-zsk1-5fcb Aliases: CVE-2014-0046 GHSA-4q53-fqhc-cr46	ember-source Cross-site Scripting vulnerability Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.	1.3.2 Affected by 0 other vulnerabilities. 1.4.0.beta.1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 1.4.0.beta.6 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-42k5-zsk1-5fcb
Aliases:
CVE-2014-0046
GHSA-4q53-fqhc-cr46

ember-source Cross-site Scripting vulnerability Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.

1.3.2
Affected by 0 other vulnerabilities.

1.4.0.beta.1
Affected by 3 other vulnerabilities.

1.4.0.beta.6
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-78w7-adb5-qfga	Potential XSS Exploit With User-Supplied Data When Binding In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, we have identified a vulnerability that could lead to unescaped content being inserted into the innerHTML string without being sanitized. When a primitive value is used as the Handlebars context, that value is not properly escaped. An example of this would be using the `{{each}}` helper to iterate over an array of user-supplied strings and using `{{this}}` inside the block to display each string. In applications that contain templates whose context is a primitive value and use the `{{this}}` keyword to display that value, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability affects applications that contain templates whose context is set to a user-supplied primitive value (such as a string or number) and also contain the `{{this}}` special Handlebars variable to display the value.	CVE-2014-0013 GHSA-8xm3-gm7c-5fjx
VCID-d7x3-kr4s-hqa9	Potential XSS Exploit In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to `innerHTML`. However, we have identified a vulnerability that could lead to unescaped content being inserted into the `innerHTML` string without being sanitized. When using the `{{group}}` helper, user supplied content in the template was not being sanitized. Though the vulnerability exists in Ember.js proper, it is only exposed via the use of an experimental plugin. In applications that use the `{{group}}` helper, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain (`XSS`). This vulnerability only affects applications that use the `{{group}}` helper to display user-provided content.	CVE-2014-0014 GHSA-rcx6-7jp6-pqf2

Vulnerability

Summary

Aliases

VCID-78w7-adb5-qfga

Potential XSS Exploit With User-Supplied Data When Binding In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, we have identified a vulnerability that could lead to unescaped content being inserted into the innerHTML string without being sanitized. When a primitive value is used as the Handlebars context, that value is not properly escaped. An example of this would be using the `{{each}}` helper to iterate over an array of user-supplied strings and using `{{this}}` inside the block to display each string. In applications that contain templates whose context is a primitive value and use the `{{this}}` keyword to display that value, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability affects applications that contain templates whose context is set to a user-supplied primitive value (such as a string or number) and also contain the `{{this}}` special Handlebars variable to display the value.

CVE-2014-0013
GHSA-8xm3-gm7c-5fjx

VCID-d7x3-kr4s-hqa9

Potential XSS Exploit In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to `innerHTML`. However, we have identified a vulnerability that could lead to unescaped content being inserted into the `innerHTML` string without being sanitized. When using the `{{group}}` helper, user supplied content in the template was not being sanitized. Though the vulnerability exists in Ember.js proper, it is only exposed via the use of an experimental plugin. In applications that use the `{{group}}` helper, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain (`XSS`). This vulnerability only affects applications that use the `{{group}}` helper to display user-provided content.

CVE-2014-0014
GHSA-rcx6-7jp6-pqf2

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-04T20:14:33.466479+00:00	GitLab Importer	Affected by	VCID-42k5-zsk1-5fcb	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/ember-source/CVE-2014-0046.yml	38.6.0
2026-06-04T20:11:12.791476+00:00	GitLab Importer	Fixing	VCID-78w7-adb5-qfga	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/ember-source/CVE-2014-0013.yml	38.6.0
2026-06-04T20:11:12.284134+00:00	GitLab Importer	Fixing	VCID-d7x3-kr4s-hqa9	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/ember-source/CVE-2014-0014.yml	38.6.0
2026-06-04T18:09:04.154787+00:00	Ruby Importer	Affected by	VCID-42k5-zsk1-5fcb	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ember-source/CVE-2014-0046.yml	38.6.0