QID 981412

Security update has been released for @github/paste-markdown to fix the vulnerability.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

A self Cross-Site Scripting vulnerability exists in the @github/paste-markdown library. If the clipboard data contains the string `<table>`, a **div** is dynamically created, and the clipboard content is copied into its **innerHTML** property without any sanitization, resulting in improper execution of JavaScript in the browser of the victim (the user who pasted the code). Users directed to copy text from a malicious website and paste it into pages that utilize this library are affected.

The following @github/paste-markdown code snippet is triggered when the user pastes something and the browser's clipboard data contains an entry whose content-type is **text/HTML**.

```typescript
function generateText(transfer: DataTransfer): string | undefined {
if (Array.from(transfer.types).indexOf('text/html') === -1) return

let html = transfer.getData('text/html')
if (!/<table/i.test(html)) return

html = html.replace(/<meta.*?>/, ')

const el = document.createElement('div')
el.innerHTML = html
const tables = el.querySelectorAll('table')

for (const table of tables) {
if (table.closest('[data-paste-markdown-skip]')) {
table.replaceWith(new Text(table.textContent || '))
}
const formattedTable = tableMarkdown(table)
table.replaceWith(new Text(formattedTable))
}

return el.innerHTML
}
```