CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS

Description

CryptPad is an end-to-end encrypted collaborative office suite. In versions prior to 2026.2.0, the HTML sanitizer in Diffmarked.js can be bypassed due to incomplete attribute filtering on restricted tags. The sanitizer validates only the src attribute of <iframe>, <video>, and <audio> elements, leaving all other attributes unchecked. As a result, an attacker can inject arbitrary HTML through srcdoc, completely defeating CryptPad's intended bounce sandboxing and enabling link injection or other interactive content within user-controlled documents. The root cause lies in how the sanitizer classifies and enforces tag restrictions: although it defines both forbidden and restricted tag lists, <iframe> is treated as "restricted" rather than "forbidden." Enforcement then inspects only the src attribute, so pairing a benign blob: src with a malicious srcdoc results in unrestricted rendering. This issue has been fixed in version 2026.2.0.

Scores

EPSS (exploitation in 30 days)

0.24% · top 85% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.

Weakness

• CWE-116: Improper Encoding or Escaping of Output (opens in a new tab)All about CWE-116 and its CVEs
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

• cryptpad · cryptpad

  • affected < 2026.2.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• npmcryptpadGHSA-g2g4-47gv-p72v (opens in a new tab)

References (2)

• https://github.com/cryptpad/cryptpad/security/advisories/GHSA-g2g4-47gv-p72v (opens in a new tab)x_refsource_CONFIRM
• https://github.com/cryptpad/cryptpad/releases/tag/2026.2.0 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-g2g4-47gv-p72v (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-26028](https://trackcve.app/badge/CVE-2026-26028.svg)](https://trackcve.app/cve/CVE-2026-26028)

Record last updated 20 May 2026, 19:33 UTC.