Skip to content
Fencer Intel
medium 6.1

CVE-2013-4170 json

Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data

published 2022-06-30 4 y ago modified 2026-09-10 1 mo ago also GHSA-5m48-c37x-f792 , EUVD-2022-6246

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 61%
public exploits
0
none known

Summary

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.

Patch / fix

  • rubygems ember-source 1.0.0.rc1.1, 1.0.0.rc2.1, 1.0.0.rc3.1, 1.0.0.rc4.1, 1.0.0.rc5.1, 1.0.0.rc6.1
  • emberjs ember.js 1.0.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2013-4170 updated cvss 5.9

ember.js: Cross-site scripting when binding `tagName` to User-Supplied Data

  • Red Hat Enterprise Linux 6 pcs Red Hat Enterprise Linux 7 pcs, pcs-snmp, python-clufter Red Hat Enterprise Linux 8 pcs, pcs-snmp
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.94% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
rubygems ember-source
<1.0.0.rc1.1
>=1.0.0.rc2.0, <1.0.0.rc2.1
>=1.0.0.rc3.0, <1.0.0.rc3.1
>=1.0.0.rc4.0, <1.0.0.rc4.1
>=1.0.0.rc5.0, <1.0.0.rc5.1
>=1.0.0.rc6.0, <1.0.0.rc6.1
1.0.0.rc1.1
1.0.0.rc2.1
1.0.0.rc3.1
1.0.0.rc4.1
1.0.0.rc5.1
1.0.0.rc6.1

Affected products

  • n/a ember-source

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.