Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data (CVE-2013-4170)

Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data (CVE-2013-4170) | HOL Guard CVE

Why this deserves its current priority

CVSS is 6.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps ember-source (rubygems), ember-source (rubygems), ember-source (rubygems), ember-source (rubygems) and additional mapped packages. Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
ember-sourcerubygems	>=0 <1.0.0.rc1.1	1.0.0.rc1.1
ember-sourcerubygems	>=1.0.0.rc2.0 <1.0.0.rc2.1	1.0.0.rc2.1
ember-sourcerubygems	>=1.0.0.rc3.0 <1.0.0.rc3.1	1.0.0.rc3.1
ember-sourcerubygems	>=1.0.0.rc4.0 <1.0.0.rc4.1	1.0.0.rc4.1
ember-sourcerubygems	>=1.0.0.rc5.0 <1.0.0.rc5.1	1.0.0.rc5.1
ember-sourcerubygems	>=1.0.0.rc6.0 <1.0.0.rc6.1	1.0.0.rc6.1

Recommended response

Check inventory. Check lockfiles and deployed manifests for ember-source, ember-source, ember-source.
Review the reported fix. Update ember-source to 1.0.0.rc1.1; ember-source to 1.0.0.rc2.1; ember-source to 1.0.0.rc3.1; ember-source to 1.0.0.rc4.1; ember-source to 1.0.0.rc5.1; ember-source to 1.0.0.rc6.1 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jul 1, 2022
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Sep 10, 2026

Sources and claim methodology

Upstream source description

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.

Quoted source text, attributed separately from HOL analysis.