Strix
26.1K

CVE-2021-37700

MEDIUMCVSS 6.1/10EPSS 1.66%

Last modified

CVE-2021-37700 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. @github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. EPSS estimates a 1.66% chance of exploitation in the next 30 days.

Description

@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `<table>`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.

Metrics

CVSS 3.1
6.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Probability
1.66%

73.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
Paste-Markdown ProjectPaste-Markdown< 0.3.4

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-37700?
@github/paste-markdown is an npm package for pasting markdown objects. A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown before version 0.3.4. If the clipboard data contains the string `<table>`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected. This is fixed in version 0.3.4. Refer the to the referenced GitHub Advisory for more details including an example exploit.
How severe is CVE-2021-37700?
CVE-2021-37700 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 1.66% probability of exploitation in the next 30 days.
How do I fix CVE-2021-37700?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-37700?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST