PT-2014-3450

Name of the Vulnerable Software and Affected Versions Ember.js versions 1.2.x through 1.2.1 Ember.js versions 1.3.x through 1.3.1 Ember.js versions 1.4.x through 1.4.0-beta.5 Description A cross-site scripting XSS issue exists in the link-to helper of Ember.js. This allows remote attackers to...

Ember.js XSS Vulnerability With {{link-to}} Helper in Non-block Form

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, a change made to the implementation of the link-to helper means that any user-supplied data bound to the link-to helper's title attribute will not be escaped...