Cross-Site Scripting in backbone

Description

Affected versions of backbone are vulnerable to cross-site scripting when users are allowed to supply input to the Model#Escape function, and the output is then written to the DOM.

The vulnerability occurs as a result of the regular expression used to encode metacharacters failing to take HTML Entities such as < into account.

Recommendation

Update the backbone package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.3.3, < 0.5.0
• Patched version(s): 0.5.0

References

• GHSA-j6p2-cx3w-6jcp
• backbonejs.org
• CVE-2016-10537
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6