VulnerableCode Package Details - pkg:gem/ember-source@1.4.0.beta.1

Search for packages

Vulnerability	Summary	Fixed by
VCID-42k5-zsk1-5fcb Aliases: CVE-2014-0046 GHSA-4q53-fqhc-cr46	ember-source Cross-site Scripting vulnerability Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.	1.4.0.beta.6 Affected by 0 other vulnerabilities.
VCID-78w7-adb5-qfga Aliases: CVE-2014-0013	Potential XSS Exploit With User-Supplied Data When Binding In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, we have identified a vulnerability that could lead to unescaped content being inserted into the innerHTML string without being sanitized. When a primitive value is used as the Handlebars context, that value is not properly escaped. An example of this would be using the `{{each}}` helper to iterate over an array of user-supplied strings and using `{{this}}` inside the block to display each string. In applications that contain templates whose context is a primitive value and use the `{{this}}` keyword to display that value, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability affects applications that contain templates whose context is set to a user-supplied primitive value (such as a string or number) and also contain the `{{this}}` special Handlebars variable to display the value.	1.4.0.beta.2 Affected by 0 other vulnerabilities.
VCID-d7x3-kr4s-hqa9 Aliases: CVE-2014-0014	Potential XSS Exploit In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to `innerHTML`. However, we have identified a vulnerability that could lead to unescaped content being inserted into the `innerHTML` string without being sanitized. When using the `{{group}}` helper, user supplied content in the template was not being sanitized. Though the vulnerability exists in Ember.js proper, it is only exposed via the use of an experimental plugin. In applications that use the `{{group}}` helper, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain (`XSS`). This vulnerability only affects applications that use the `{{group}}` helper to display user-provided content.	1.4.0.beta.2 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-42k5-zsk1-5fcb
Aliases:
CVE-2014-0046
GHSA-4q53-fqhc-cr46

ember-source Cross-site Scripting vulnerability Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.

1.4.0.beta.6
Affected by 0 other vulnerabilities.

VCID-78w7-adb5-qfga
Aliases:
CVE-2014-0013

Potential XSS Exploit With User-Supplied Data When Binding In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, we have identified a vulnerability that could lead to unescaped content being inserted into the innerHTML string without being sanitized. When a primitive value is used as the Handlebars context, that value is not properly escaped. An example of this would be using the `{{each}}` helper to iterate over an array of user-supplied strings and using `{{this}}` inside the block to display each string. In applications that contain templates whose context is a primitive value and use the `{{this}}` keyword to display that value, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability affects applications that contain templates whose context is set to a user-supplied primitive value (such as a string or number) and also contain the `{{this}}` special Handlebars variable to display the value.

1.4.0.beta.2
Affected by 0 other vulnerabilities.

VCID-d7x3-kr4s-hqa9
Aliases:
CVE-2014-0014

Potential XSS Exploit In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to `innerHTML`. However, we have identified a vulnerability that could lead to unescaped content being inserted into the `innerHTML` string without being sanitized. When using the `{{group}}` helper, user supplied content in the template was not being sanitized. Though the vulnerability exists in Ember.js proper, it is only exposed via the use of an experimental plugin. In applications that use the `{{group}}` helper, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain (`XSS`). This vulnerability only affects applications that use the `{{group}}` helper to display user-provided content.

1.4.0.beta.2
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-02T04:38:12.525891+00:00	GitLab Importer	Affected by	VCID-42k5-zsk1-5fcb	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/ember-source/CVE-2014-0046.yml	38.6.0
2026-06-02T04:37:31.773231+00:00	GitLab Importer	Affected by	VCID-78w7-adb5-qfga	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/ember-source/CVE-2014-0013.yml	38.6.0
2026-06-02T04:37:31.409519+00:00	GitLab Importer	Affected by	VCID-d7x3-kr4s-hqa9	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/ember-source/CVE-2014-0014.yml	38.6.0