Log in Start free

Vulnerability · Published Aug 12, 2021 · Assigned by GitHub_M

CVE-2021-37700Clipboard-based DOM-XSS

Medium 6.5

In plain English

A medium-severity cross-site scripting in paste-markdown from github. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.7%top 23.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `<table>`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npm@github/paste-markdown0.3.4GHSA-gpfj-4j6g-c4w9

Affected products (as reported)

VendorProductVersions
github paste-markdown < 0.3.4

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References