Vulnerability Description
@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `<table>`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Paste-Markdown Project | Paste-Markdown | < 0.3.4 |
Related Weaknesses (CWE)
References
- https://github.com/github/paste-markdown/commit/32b7ea3f29ae8f256f9d19768387be42PatchThird Party Advisory
- https://github.com/github/paste-markdown/releases/tag/v0.3.4Release NotesThird Party Advisory
- https://github.com/github/paste-markdown/security/advisories/GHSA-gpfj-4j6g-c4w9ExploitThird Party Advisory
- https://www.npmjs.com/package/%40github/paste-markdown
- https://github.com/github/paste-markdown/commit/32b7ea3f29ae8f256f9d19768387be42PatchThird Party Advisory
- https://github.com/github/paste-markdown/releases/tag/v0.3.4Release NotesThird Party Advisory
- https://github.com/github/paste-markdown/security/advisories/GHSA-gpfj-4j6g-c4w9ExploitThird Party Advisory
- https://www.npmjs.com/package/%40github/paste-markdown
FAQ
What is CVE-2021-37700?
CVE-2021-37700 is a vulnerability with a CVSS score of 6.5 (MEDIUM). @github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contai...
How severe is CVE-2021-37700?
CVE-2021-37700 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-37700?
Check the references section above for vendor advisories and patch information. Affected products include: Paste-Markdown Project Paste-Markdown.