Clipboard-based XSS

中 5.4CVE-2021-41086 · GHSA-qh7x-j4v8-qw5w · 21/09/2021 公開 · 17/06/2026 更新

要点

CVE-2021-41086 は jsuites (jsuites), jsuites に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.91%（全脆弱性の 60.3% より高い）。
対処：4.9.11 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
jsuites jsuites	`< 4.9.11`	`4.9.11`
jsuites npm	`< 4.9.11`	`4.9.11`

概要

Impact

XSS against the user.

Details

jsuites is vulnerable to DOM based XSS if the user can be tricked into copying anything from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to innerHTML causing XSS.

References

The Curious Case of Copy & Paste – on risks of pasting arbitrary content in browsers: https://research.securitum.com/the-curious-case-of-copy-paste/

NVD の説明

jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting (XSS) attacks via clipboard content. jsuites is vulnerable to DOM based XSS if the user can be tricked into copying _anything_ from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to `innerHTML` allowing for javascript injection and thus XSS. Users are advised to update to version 4.9.11 to resolve.