CVE-2021-37700

Katalog CVE

CVSS 6.1 · Medium EPSS 1,7%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada paste-markdown project paste-markdown. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `<table>`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.

Rincian

Terbit di NVD

12 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/github/paste-markdown/commit/32b7ea3f29ae8f256f9d19768387be42678ddf30 patch · advisory pihak ketiga
• https://github.com/github/paste-markdown/releases/tag/v0.3.4 release notes · advisory pihak ketiga
• https://github.com/github/paste-markdown/security/advisories/GHSA-gpfj-4j6g-c4w9 exploit · advisory pihak ketiga
• https://www.npmjs.com/package/%40github/paste-markdown