CVE-2026-26028
HTML Sanitizer Bypass in CryptPad via srcdoc Injection
Publication date: 2026-05-20
Last updated on: 2026-05-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cryptpad | cryptpad | to 5.9.0 (exc) |
| cryptpad | cryptpad | 2026.2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-116 | The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-26028 is a vulnerability in CryptPad's HTML sanitizer located in Diffmarked.js. The sanitizer is supposed to filter HTML attributes on certain restricted tags like <iframe>, <video>, and <audio>. However, it only validates the src attribute and ignores other attributes such as srcdoc.
Because of this incomplete filtering, an attacker can inject arbitrary HTML content through the srcdoc attribute, bypassing the intended sandboxing protections. This allows malicious interactive content or links to be embedded within user-controlled documents.
The root cause is that the sanitizer treats <iframe> as a restricted tag rather than a forbidden one, so it only inspects the src attribute. Pairing a benign src with a malicious srcdoc results in unrestricted rendering of harmful content.
This vulnerability was fixed in CryptPad version 2026.2.0.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to inject arbitrary HTML content into CryptPad documents, potentially leading to Cross-Site Scripting (XSS) attacks.
Such injected content could include malicious links or interactive elements that deceive users, compromising the confidentiality and integrity of data.
The attack can be performed remotely over the network without requiring privileges, but it does require user interaction to trigger.
The CVSS score for this vulnerability is 6.1 (Moderate severity), reflecting the potential impact on confidentiality and integrity but no impact on availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the injection of arbitrary HTML through the srcdoc attribute in <iframe> elements within CryptPad documents. Detection would involve inspecting user-generated content or network traffic for suspicious <iframe> tags that include a benign src attribute paired with a malicious srcdoc attribute.
Since the vulnerability is related to HTML content sanitization bypass, detection on the system or network could include searching for HTML payloads containing <iframe> tags with srcdoc attributes.
- Use grep or similar tools to scan stored documents or logs for occurrences of <iframe> tags with srcdoc attributes, e.g., grep -r '<iframe[^>]*srcdoc=' /path/to/cryptpad/data
- Monitor network traffic for HTTP requests or responses containing suspicious <iframe> tags with srcdoc attributes using tools like Wireshark or tcpdump with filters for HTTP payloads.
- Use content inspection commands or scripts to parse and analyze HTML content for iframe tags that have srcdoc attributes, which should not be present or allowed.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade CryptPad to version 2026.2.0 or later, where this vulnerability has been fixed.
Until the upgrade can be applied, restrict user input that can include <iframe> tags with srcdoc attributes or disable features that allow embedding such content.
Educate users to avoid interacting with suspicious links or content that could exploit this vulnerability, as it requires user interaction.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in CryptPad's HTML sanitizer allows arbitrary HTML injection, which can lead to Cross-Site Scripting (XSS) attacks. Such attacks pose risks to the confidentiality and integrity of user data.
Because this vulnerability can compromise data confidentiality and integrity, it may impact compliance with data protection standards and regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access or manipulation.
However, the provided information does not explicitly discuss compliance implications or specific regulatory impacts.