Clipboard-based DOM-XSS

Description

A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown library.

Recommendation

Update the @github/paste-markdown package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.3.4
• Patched version(s): 0.3.4

References

• GHSA-gpfj-4j6g-c4w9
• www.npmjs.com
• CVE-2021-37700
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Clipboard-based XSS - CVE-2021-41086
• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - CVE-2025-53892
• DOM-based XSS in gmail-js - CVE-2016-1000228
• vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes - vue-i18n - CVE-2025-53892

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@github/paste-markdown