CVE-2013-4170

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.

• CWE-79
• CWE-79

• https://groups.google.com/g/ember-security/c/dokLVwwxAdMMailing List, Patch, Third Party Advisory
• https://rubysec.com/advisories/CVE-2013-4170/Third Party Advisory
• https://security.snyk.io/vuln/SNYK-RUBY-EMBERSOURCE-20102Patch, Third Party Advisory
• https://groups.google.com/g/ember-security/c/dokLVwwxAdMMailing List, Patch, Third Party Advisory
• https://rubysec.com/advisories/CVE-2013-4170/Third Party Advisory
• https://security.snyk.io/vuln/SNYK-RUBY-EMBERSOURCE-20102Patch, Third Party Advisory

Published

Jun 30, 2022

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4164Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p48…
• CVE-2013-4165The HTTPAuthorized function in bitcoinrpc.cpp in bitcoind 0.…
• CVE-2013-4166The gpg_ctx_add_recipient function in camel/camel-gpg-contex…7.5
• CVE-2013-4167Cross-site scripting (XSS) vulnerability in CMS Made Simple …
• CVE-2013-4168Cross-site scripting (XSS) vulnerability in SmokePing 2.6.9 …6.1
• CVE-2013-4169GNOME Display Manager (gdm) before 2.21.1 allows local users…
• CVE-2013-4171Multiple cross-site scripting (XSS) vulnerabilities in Apach…
• CVE-2013-4172The Red Hat CloudForms Management Engine 5.1 allow remote ad…
• CVE-2013-4173Directory traversal vulnerability in the trend-data daemon (…
• CVE-2013-4174Multiple cross-site scripting (XSS) vulnerabilities in the S…
• CVE-2013-4175MySecureShell 1.31 has a Local Denial of Service Vulnerabili…5.5
• CVE-2013-4176mysecureshell 1.31: Local Information Disclosure Vulnerabili…5.5