Ember.js vulnerabilitiesEmber.js: known vulnerabilities and safe versions
npm: ember-source
Ember.js has 12 known vulnerability records: 0 in the npm advisory data (GitHub Advisory Database via OSV, the same source npm audit uses) and 12 only in Retire.js (CDN builds and advisories without a CVE).
By branch: 4.x has no fixed release in the records; 3.x is safe from 3.28.10; 2.x has no fixed release in the records; 1.x has no fixed release in the records.
Vulnerabilities and safe version by branch
Safe version: on that branch, this release and every later one (up to the branch's latest release, where known) fall outside every known record's range. Candidates are only the records' own fixed versions and the branch's latest release; "No fix" means moving off the branch.
| Branch | Support | Latest on branch | Records | Safe version |
|---|---|---|---|---|
| 4.x | — | — | 3high | No fix |
| 3.x | — | — | 2high | 3.28.10 |
| 2.x | — | — | 2high | No fix |
| 1.x | — | — | 5high | No fix |
| 0.9.x | — | — | 4high | No fix |
Support dates appear only for libraries that endoflife.date tracks.
Records
Newest first. Ranges are the record's own data; several ranges mean separate fixes per branch.
CVE-2013-41702022-06-30
In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML.
Affected versions: >= 1.0.0-rc.1, < 1.0.0-rc.1.1 · >= 1.0.0-rc.2, < 1.0.0-rc.2.1 · >= 1.0.0-rc.3, < 1.0.0-rc.3.1 · >= 1.0.0-rc.4, < 1.0.0-rc.4.1 · >= 1.0.0-rc.5, < 1.0.0-rc.5.1 · >= 1.0.0-rc.6, < 1.0.0-rc.6.1
medium 6.1
Fixed in: 1.0.0-rc.6.1, 1.0.0-rc.5.1, 1.0.0-rc.4.1, 1.0.0-rc.3.1
CVE-2014-00142018-02-15
Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attacke
Affected versions: >= 1.0.0, < 1.0.1 · >= 1.1.0, < 1.1.3 · >= 1.2.0, < 1.2.1 · >= 1.3.0, < 1.3.1 · >= 1.4.0, < 1.4.0-beta.2
medium 5.4
Fixed in: 1.0.1, 1.1.3, 1.2.1, 1.3.1
EPSS 1.1%
CVE-2014-00132018-02-15
Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attacke
Affected versions: >= 1.0.0, < 1.0.1 · >= 1.1.0, < 1.1.3 · >= 1.2.0, < 1.2.1 · >= 1.3.0, < 1.3.1 · >= 1.4.0, < 1.4.0-beta.2
medium 5.4
Fixed in: 1.0.1, 1.1.3, 1.2.1, 1.3.1
CVE-2015-75652017-04-13
Cross-site scripting (XSS) vulnerability in Ember.js 1.8.x through 1.10.x, 1.11.x before 1.11.4, 1.12.x before 1.12.2, 1.13.x before 1.13.12
Affected versions: >= 1.8.0, < 1.11.4 · >= 1.12.0, < 1.12.2 · >= 1.13.0, < 1.13.12 · >= 2.0.0, < 2.0.3 · >= 2.1.0, < 2.1.2 · >= 2.2.0, < 2.2.1
medium 6.1
Fixed in: 1.11.4, 1.12.2, 1.13.12, 2.0.3
CVE-2014-00462014-02-27
Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-be
Affected versions: >= 1.2.0, < 1.2.2 · >= 1.3.0, < 1.3.2 · < 1.5.0
low 2.6
Fixed in: 1.2.2, 1.3.2, 1.5.0
EPSS 1.5%
no CVE
Prototype pollution
Affected versions: >= 4.9.0-alpha.1, < 4.9.0-beta.3
high
Fixed in: 4.9.0-beta.3
no CVE
Prototype pollution
Affected versions: >= 4.5.0, < 4.8.1
high
Fixed in: 4.8.1
no CVE
Prototype pollution
Affected versions: >= 4.0.0, < 4.4.4
high
Fixed in: 4.4.4
no CVE
Prototype pollution
Affected versions: >= 3.25.0, < 3.28.10
high
Fixed in: 3.28.10
no CVE
Prototype pollution
Affected versions: < 3.24.7
high
Fixed in: 3.24.7
no CVE
More rigorous XSS escaping from bindAttr
Affected versions: < 0.9.7.1
low
Fixed in: 0.9.7.1
no CVE
Bound attributes aren't escaped properly
Affected versions: < 0.9.7
high
Fixed in: 0.9.7
Sources and method
Ranges: GitHub Advisory Database (OSV npm export, daily) and Retire.js (Apache-2.0). Exploitation: CISA KEV, FIRST EPSS and exploit maturity from the Noroxi CVE database. Support dates: endoflife.date.
This page and the JavaScript library scan use the same matching rule: a row without bounds is not evidence, and versions are compared in one place. A record without a version range never counts as "affected" in the version check.
Data as of October 23, 2026.