CVE-2021-37700
Description
@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string ``, a div is dynamically created, and the clipboard content is copied into its innerHTML property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@github/paste-markdownnpm | < 0.3.4 | 0.3.4 |
Affected products
3- cpe:2.3:a:paste-markdown_project:paste-markdown:*:*:*:*:*:node.js:*:*Range: <0.3.4
- Range: < 0.3.4
Patches
Vulnerability mechanics
References
7- github.com/github/paste-markdown/commit/32b7ea3f29ae8f256f9d19768387be42678ddf30nvdPatchThird Party AdvisoryWEB
- github.com/github/paste-markdown/security/advisories/GHSA-gpfj-4j6g-c4w9nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-gpfj-4j6g-c4w9ghsaADVISORY
- github.com/github/paste-markdown/releases/tag/v0.3.4nvdRelease NotesThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2021-37700ghsaADVISORY
- www.npmjs.com/package/@github/paste-markdownghsaWEB
- www.npmjs.com/package/%40github/paste-markdownnvd
News mentions
0No linked articles in our index yet.