{"id":"CVE-2021-37700","aliases":["EUVD-2021-1726","GHSA-gpfj-4j6g-c4w9"],"status":"published","title":"Clipboard-based DOM-XSS","description":"@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `\u003ctable\u003e`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0166,"percentile":0.7687,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2021-08-12T20:42:17Z","modified":"2026-10-20T10:54:51Z","fixes":[{"ecosystem":"npm","package":"@github/paste-markdown","fixed_in":["0.3.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@github/paste-markdown","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.4"}]}]},{"source":"osv","ecosystem":"npm","package":"@github/paste-markdown","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.4"}]}]}],"products":[{"vendor":"github","product":"paste-markdown"},{"vendor":"paste-markdown_project","product":"paste-markdown"}],"references":[{"url":"https://github.com/github/paste-markdown/security/advisories/GHSA-gpfj-4j6g-c4w9","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/github/paste-markdown/commit/32b7ea3f29ae8f256f9d19768387be42678ddf30","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/github/paste-markdown/releases/tag/v0.3.4","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://www.npmjs.com/package/%40github/paste-markdown","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.npmjs.com/package/@github/paste-markdown","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37700","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gpfj-4j6g-c4w9"},{"url":"https://github.com/github/paste-markdown","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-37700","title":"Clipboard-based DOM-XSS","description":"@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `\u003ctable\u003e`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.","status":"published","published":"2021-08-12T20:45:13Z","modified":"2024-08-04T01:23:01.457Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:58.359368Z"}],"euvd":[{"id":"EUVD-2021-1726","description":"@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `\u003ctable\u003e`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.","status":"published","published":"2021-08-12T20:45:13Z","modified":"2024-08-04T01:23:01Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:24:27.254804Z"}],"ghsa":[{"id":"GHSA-gpfj-4j6g-c4w9","title":"Clipboard-based DOM-XSS","description":"### Impact\n\nA self Cross-Site Scripting vulnerability exists in the @github/paste-markdown library. If the clipboard data contains the string `\u003ctable\u003e`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected.\n\nThe following @github/paste-markdown code snippet is triggered when the user pastes something and the browser's clipboard data contains an entry whose content-type is **text/HTML**.\n\n```typescript\nfunction generateText(transfer: DataTransfer): string | undefined {\n  if (Array.from(transfer.types).indexOf('text/html') === -1) return\n\n  let html = transfer.getData('text/html')\n  if (!/\u003ctable/i.test(html)) return\n\n  html = html.replace(/\u003cmeta.*?\u003e/, '')\n\n  const el = document.createElement('div')\n  el.innerHTML = html\n  const tables = el.querySelectorAll('table')\n\n  for (const table of tables) {\n    if (table.closest('[data-paste-markdown-skip]')) {\n      table.replaceWith(new Text(table.textContent || ''))\n    }\n    const formattedTable = tableMarkdown(table)\n    table.replaceWith(new Text(formattedTable))\n  }\n\n  return el.innerHTML\n}\n```\n\n### Patches\nA security patch was released in [version 0.3.4](https://github.com/github/paste-markdown/releases/tag/v0.3.4).\n\n### Workarounds\nA Content Security Policy that prevents `unsafe-inline` helps reduce the likelihood of this vulnerability being exploited in modern browsers.\n\n\u003c!--\n### References\n_Are there any links users can visit to find out more?_\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [example link to repo](http://example.com)\n* Email us at [example email address](mailto:example@example.com)\n*\n--\u003e\n","status":"published","published":"2021-08-12T20:42:17Z","modified":"2023-02-01T05:06:03Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:36.66596Z"}],"nvd":[{"id":"CVE-2021-37700","description":"@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `\u003ctable\u003e`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.","status":"published","published":"2021-08-12T21:15:09.173Z","modified":"2026-06-17T04:01:00.793Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:56.943671Z"}],"osv":[{"id":"CVE-2021-37700","description":"@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `\u003ctable\u003e`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.","status":"published","published":"2021-08-12T21:15:09.173Z","modified":"2026-10-20T10:54:51.135950964Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"GHSA-gpfj-4j6g-c4w9","title":"Clipboard-based DOM-XSS","description":"### Impact\n\nA self Cross-Site Scripting vulnerability exists in the @github/paste-markdown library. If the clipboard data contains the string `\u003ctable\u003e`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected.\n\nThe following @github/paste-markdown code snippet is triggered when the user pastes something and the browser's clipboard data contains an entry whose content-type is **text/HTML**.\n\n```typescript\nfunction generateText(transfer: DataTransfer): string | undefined {\n  if (Array.from(transfer.types).indexOf('text/html') === -1) return\n\n  let html = transfer.getData('text/html')\n  if (!/\u003ctable/i.test(html)) return\n\n  html = html.replace(/\u003cmeta.*?\u003e/, '')\n\n  const el = document.createElement('div')\n  el.innerHTML = html\n  const tables = el.querySelectorAll('table')\n\n  for (const table of tables) {\n    if (table.closest('[data-paste-markdown-skip]')) {\n      table.replaceWith(new Text(table.textContent || ''))\n    }\n    const formattedTable = tableMarkdown(table)\n    table.replaceWith(new Text(formattedTable))\n  }\n\n  return el.innerHTML\n}\n```\n\n### Patches\nA security patch was released in [version 0.3.4](https://github.com/github/paste-markdown/releases/tag/v0.3.4).\n\n### Workarounds\nA Content Security Policy that prevents `unsafe-inline` helps reduce the likelihood of this vulnerability being exploited in modern browsers.\n\n\u003c!--\n### References\n_Are there any links users can visit to find out more?_\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [example link to repo](http://example.com)\n* Email us at [example email address](mailto:example@example.com)\n*\n--\u003e\n","status":"published","published":"2021-08-12T20:42:17Z","modified":"2026-07-08T06:28:23.280733876Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.191583Z"}]}}