GHSA-j6p2-cx3w-6jcp

    Dashboard / Vulnerabilities / GHSA-j6p2-cx3w-6jcp

    GHSA-j6p2-cx3w-6jcp

    Published: 18 Feb 2019Last Modified: 3 Feb 2026

    Summary: Cross-Site Scripting in backbone

    Details: Affected versions of `backbone` are vulnerable to cross-site scripting when users are allowed to supply input to the `Model#Escape` function, and the output is then written to the DOM. The vulnerability occurs as a result of the regular expression used to encode metacharacters failing to take HTML Entities such as `<` into account. ## Recommendation Update to version 0.5.0 or later.

    References: https://nvd.nist.gov/vuln/detail/CVE-2016-10537, https://github.com/jashkenas/backbone/commit/0cdc525961d3fa98e810ffae6bcc8e3838e36d93, https://github.com/jashkenas/backbone/commit/7ae0384120c2552e1c426cda7fb02fdce6ef1076, https://backbonejs.org/#changelog, https://github.com/jashkenas/backbone, https://github.com/jashkenas/backbone/blame/0cdc525961d3fa98e810ffae6bcc8e3838e36d93/backbone.js, https://github.com/jashkenas/backbone/compare/0.3.3...0.5.0#diff-0d56d0d310de7ff18b3cef9c2f8f75dcL1008

    Affected packages

    Package

    Name: backbone

    Purl: pkg:npm/backbone

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0.3.3
    Fixed -0.5.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High