CryptPad up to 2026.2.0 srcdoc Diffmarked.js sanitizer src cross site scripting

Summaryinfo

A vulnerability described as problematic has been identified in CryptPad up to 2026.2.0. Affected by this vulnerability is the function sanitizer of the file Diffmarked.js of the component srcdoc Handler. Executing a manipulation of the argument src can lead to cross site scripting. This vulnerability is handled as CVE-2026-26028. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in CryptPad up to 2026.2.0 and classified as problematic. This vulnerability affects the function sanitizer of the file Diffmarked.js of the component srcdoc Handler. The manipulation of the argument src with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-80. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. As an impact it is known to affect integrity. CVE summarizes:

CryptPad is an end-to-end encrypted collaborative office suite. In versions prior to 2026.2.0, the HTML sanitizer in Diffmarked.js can be bypassed due to incomplete attribute filtering on restricted tags. The sanitizer validates only the src attribute of <iframe>, <video>, and <audio> elements, leaving all other attributes unchecked. As a result, an attacker can inject arbitrary HTML through srcdoc, completely defeating CryptPad's intended bounce sandboxing and enabling link injection or other interactive content within user-controlled documents. The root cause lies in how the sanitizer classifies and enforces tag restrictions: although it defines both forbidden and restricted tag lists, <iframe> is treated as "restricted" rather than "forbidden." Enforcement then inspects only the src attribute, so pairing a benign blob: src with a malicious srcdoc results in unrestricted rendering. This issue has been fixed in version 2026.2.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-26028 since 02/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 2026.2.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-31154). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• CryptPad

Version

• 2026.0
• 2026.1
• 2026.2.0

Website

• Product: https://github.com/cryptpad/cryptpad/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion