Cross-Site Scripting in backbone

Description

Affected versions of backbone are vulnerable to cross-site scripting when users are allowed to supply input to the Model#Escape function, and the output is then written to the DOM.

The vulnerability occurs as a result of the regular expression used to encode metacharacters failing to take HTML Entities such as < into account.

Recommendation

Update the backbone package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.3.3, < 0.5.0
• Patched version(s): 0.5.0

References

• GHSA-j6p2-cx3w-6jcp
• backbonejs.org
• CVE-2016-10537
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Cross-Site Scripting (XSS) in pivottable - CVE-2016-1000241
• Cross-Site Scripting in swagger-ui - swagger-ui - GHSA-p239-93f7-h6xf - CVE-2016-5682
• Cross-Site Scripting in jqtree - CVE-2016-1000234
• Cross-Site Scripting in nunjucks - CVE-2016-10547

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

backbone