Description
backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the `Model#Escape` function of backbone 0.3.3 and earlier, if a user is able to supply input. This is due to the regex that's replacing things to miss the conversion of things such as `<` to `<`.
Remediation
References
Related Vulnerabilities
WordPress Plugin User Registration, Login & Landing Pages-LeadMagic Cross-Site Scripting (1.2.7)
Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-2165)
Apache HTTP Server Other Vulnerability (CVE-1999-1199)
WordPress 4.1.x Cross-Domain Flash Injection Vulnerability (4.1 - 4.1.21)