Executive brief
The @github/paste-markdown library is a JavaScript component that processes clipboard content when users paste data into web pages. A vulnerability allows attackers to execute malicious JavaScript in a victim's browser by tricking users into copying HTML from a malicious website and pasting it into a page using this library, compromising the victim's session or stealing sensitive information visible to their account.
Technical details
This is a DOM-based cross-site scripting (XSS) vulnerability (CWE-79) in the paste-markdown library's generateText function. When a user pastes clipboard data containing the text/html MIME type with a <table> tag, the code creates a div element and directly assigns the unsanitized HTML to its innerHTML property without any sanitization. An attacker can craft malicious HTML containing JavaScript payloads and trick users into copying it from a malicious website and pasting it into a vulnerable application. The vulnerability requires user interaction (paste action) and is limited to the context of the pasting user (self-XSS scope), but can be exploited to steal sessions or perform actions as that user. A patch was released in version 0.3.4; Content Security Policy with unsafe-inline restrictions can mitigate the risk.
Affected products
- GitHub paste-markdown < 0.3.4
Timeline
- 2021-08-12: disclosed
- 2021-08-12: patched: Version 0.3.4 released