{"action":"Upgrade ember-source to 1.0.0.rc1.1 or later.","affected":[{"fixed":"1.0.0.rc1.1","introduced":"0"},{"fixed":"1.0.0.rc2.1","introduced":"1.0.0.rc2.0"},{"fixed":"1.0.0.rc3.1","introduced":"1.0.0.rc3.0"},{"fixed":"1.0.0.rc4.1","introduced":"1.0.0.rc4.0"},{"fixed":"1.0.0.rc5.1","introduced":"1.0.0.rc5.0"},{"fixed":"1.0.0.rc6.1","introduced":"1.0.0.rc6.0"}],"component":"ember-source","cve_ids":["CVE-2013-4170"],"ecosystem":"RubyGems","epss":0.00942,"exploited":false,"fixed_versions":["1.0.0.rc1.1","1.0.0.rc2.1","1.0.0.rc3.1","1.0.0.rc4.1","1.0.0.rc5.1","1.0.0.rc6.1"],"ghsa_id":"GHSA-5m48-c37x-f792","id":"tcs_01M5KEH27CHYWC3JK56ZV17WXG","modified_at":"2026-09-10T03:49:55.212583306Z","published_at":"2022-07-01T00:01:11Z","references":["https://osv.dev/vulnerability/GHSA-5m48-c37x-f792","https://nvd.nist.gov/vuln/detail/CVE-2013-4170","https://github.com/emberjs/ember.js","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ember-source/CVE-2013-4170.yml","https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM","https://groups.google.com/g/ember-security/c/dokLVwwxAdM","https://rubysec.com/advisories/CVE-2013-4170","https://security.snyk.io/vuln/SNYK-RUBY-EMBERSOURCE-20102"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-5m48-c37x-f792","url":"https://osv.dev/vulnerability/GHSA-5m48-c37x-f792"}],"summary":"Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data"}