Affected versions of backbone are vulnerable to cross-site scripting when users are allowed to supply input to the Model#Escape function, and the output is then written to the DOM.

The vulnerability occurs as a result of the regular expression used to encode metacharacters failing to take HTML Entities such as < into account.

Recommendation

Update to version 0.5.0 or later.

References

• https://nvd.nist.gov/vuln/detail/CVE-2016-10537
• jashkenas/backbone@0cdc525
• https://backbonejs.org/#changelog
• GHSA-j6p2-cx3w-6jcp
• https://www.npmjs.com/advisories/108
• jashkenas/backbone@0.3.3...0.5.0#diff-0d56d0d310de7ff18b3cef9c2f8f75dcL1008