[samwillis]

Ok, so there is a related vector here, but it requires the site your are on to be compromised.

I would argue the actual vector is in the terminal, it should really validate the clipboard content.