Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 14 Feb 2014 10:05:12 -0800
From: Tom Dale <>
Subject: [CVE-2014-0046] XSS Vulnerability With {{link-to}} Helper in
 Non-block Form

XSS Vulnerability With {{link-to}} Helper in Non-block Form

There is a vulnerability in the {{link-to}} helper in Ember.js. This
has been assigned CVE-2014-0046.

Versions Affected: 1.2.0, 1.2.1, 1.3.0, 1.3.1
Not affected: Versions prior to 1.2
Fixed Versions: 1.2.2, 1.3.2


In general, Ember.js escapes or strips any user-supplied content before
inserting it in strings that will be sent to innerHTML.  However, a change
to the implementation of the {{link-to}} helper means that any user-supplied
data bound to the {{link-to}} helper's title attribute will not be escaped

In applications that use the {{link-to}} helper in non-block form and bind
the title attribute to user-supplied content, a specially-crafted payload
could execute arbitrary JavaScript in the context of the current domain

All users running an affected release and binding user-supplied data to the
{{link-to}} helper's title attribute should either upgrade or use one of the
workarounds immediately.


Releases are available on


Ensure that you escape any user-supplied value that you bind to the
helper's title attribute. For example, if you bind a value named userTitle:

 {{link-to "user" title=userTitle}}

Ensure that you escape the value of userTitle using

 var userTitle = this.get('userTitle');
 var safeUserTitle = Ember.Handlebars.Utils.escapeExpression(userTitle);
 this.set('userTitle', safeUserTitle);


Patches are available as an attachment to the announcement on the
emberjs-security list:!topic/ember-security/1h6FRgr8lXQ


This vulnerability was reported to us by Hyder Ali of Zoho. Many thanks for
working with us on the patches and advisory.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.