{"action":"Upgrade backbone to 0.5.0 or later.","affected":[{"fixed":"0.5.0","introduced":"0.3.3"}],"component":"backbone","cve_ids":["CVE-2016-10537"],"ecosystem":"npm","epss":0.00675,"exploited":false,"fixed_versions":["0.5.0"],"ghsa_id":"GHSA-j6p2-cx3w-6jcp","id":"tcs_01M5KFX6D9SBAGW0DH67RPK7N1","modified_at":"2026-02-03T03:07:13.937421Z","published_at":"2019-02-18T23:39:55Z","references":["https://osv.dev/vulnerability/GHSA-j6p2-cx3w-6jcp","https://nvd.nist.gov/vuln/detail/CVE-2016-10537","https://github.com/jashkenas/backbone/commit/0cdc525961d3fa98e810ffae6bcc8e3838e36d93","https://github.com/jashkenas/backbone/commit/7ae0384120c2552e1c426cda7fb02fdce6ef1076","https://backbonejs.org/#changelog","https://github.com/jashkenas/backbone","https://github.com/jashkenas/backbone/blame/0cdc525961d3fa98e810ffae6bcc8e3838e36d93/backbone.js","https://github.com/jashkenas/backbone/compare/0.3.3...0.5.0#diff-0d56d0d310de7ff18b3cef9c2f8f75dcL1008"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-j6p2-cx3w-6jcp","url":"https://osv.dev/vulnerability/GHSA-j6p2-cx3w-6jcp"}],"summary":"Cross-Site Scripting in backbone"}