CVE-2021-37700

@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string , a div is dynamically created, and the clipboard content is copied into its...

CVE-2021-37700

The CVE-2021-37700 issue affects the npm package @github/paste-markdown. Root cause: when clipboard HTML contains a tag, the code creates a div and assigns the clipboard content to its innerHTML without sanitization, enabling DOM-based XSS in the victim’s browser. Affected version before 0.3.4; ...