CVE-2021-37700

@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `<table>`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.

• CWE-79

• https://github.com/github/paste-markdown/commit/32b7ea3f29ae8f256f9d19768387be42678ddf30Patch, Third Party Advisory
• https://github.com/github/paste-markdown/releases/tag/v0.3.4Release Notes, Third Party Advisory
• https://github.com/github/paste-markdown/security/advisories/GHSA-gpfj-4j6g-c4w9Exploit, Third Party Advisory
• https://www.npmjs.com/package/%40github/paste-markdown
• https://github.com/github/paste-markdown/commit/32b7ea3f29ae8f256f9d19768387be42678ddf30Patch, Third Party Advisory
• https://github.com/github/paste-markdown/releases/tag/v0.3.4Release Notes, Third Party Advisory
• https://github.com/github/paste-markdown/security/advisories/GHSA-gpfj-4j6g-c4w9Exploit, Third Party Advisory
• https://www.npmjs.com/package/%40github/paste-markdown

Published

Aug 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37695ckeditor is an open source WYSIWYG HTML editor with rich con…5.4
• CVE-2021-37696tmerc-cogs are a collection of open source plugins for the R…6.5
• CVE-2021-37697tmerc-cogs are a collection of open source plugins for the R…6.5
• CVE-2021-37698Icinga is a monitoring system which checks the availability …7.5
• CVE-2021-37699Next.js is an open source website development framework to b…6.1
• CVE-2021-3770vim is vulnerable to Heap-based Buffer Overflow7.8
• CVE-2021-37701The npm package "tar" (aka node-tar) before versions 4.4.16,…8.6
• CVE-2021-37702Pimcore is an open source data & experience management platf…8.8
• CVE-2021-37703Discourse is an open-source platform for community discussio…4.3
• CVE-2021-37704PhpFastCache is a high-performance backend cache system (pac…4.3
• CVE-2021-37705OneFuzz is an open source self-hosted Fuzzing-As-A-Service p…10
• CVE-2021-37706PJSIP is a free and open source multimedia communication lib…9.8