CVE Vulnerability

CVE-2021-37700

@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string ``, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/github/paste-markdown/releases/tag/v0.3.4 Release Notes Third Party Advisory
https://www.npmjs.com/package/@github/paste-markdown Product Third Party Advisory
https://github.com/github/paste-markdown/security/advisories/GHSA-gpfj-4j6g-c4w9 Exploit Third Party Advisory
https://github.com/github/paste-markdown/commit/32b7ea3f29ae8f256f9d19768387be42678ddf30 Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:paste-markdown_project:paste-markdown:*:*:*:*:*:node.js:*:*
Information

Published : 2021-08-12 09:15

Updated : 2021-08-23 02:29

NVD link : CVE-2021-37700

Mitre link : CVE-2021-37700

Products Affected
No products.
CWE
CWE-79