CVE-2013-4170

Name of the Vulnerable Software and Affected Versions Ember.js (affected versions not specified)

Description The tagName property of an Ember.View is inserted into a string without being sanitized, allowing a specially-crafted payload to execute arbitrary JavaScript in the context of the current domain, resulting in a cross-site scripting (XSS) issue. This affects applications that assign or bind user-provided content to tagName.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.