Vulnerabilities in pkg:npm/cryptpad

PACKAGE
Advisory Identifier: GHSA-g2g4-47gv-p72v
Share
Advisory Summary

CVE-2026-26028 is a MODERATE (CVSS 6.1) cross-site scripting vulnerability (CWE-116: Improper Encoding or Escaping of Output) affecting Cryptpad libraries in the npm ecosystem. The issue involves cryptpad has a sanitizer bypass in diffmarked.js that allows arbitrary html injection and potential xss. Remediation is available in the latest vendor maintenance releases.

1 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:npm/cryptpad

1 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:npm/cryptpad. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-g2g4-47gv-p72v CVE-2026-26028 MODERATE CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS

CVE-2026-26028 at a Glance

CVE Identifier CVE-2026-26028
GHSA Identifier GHSA-g2g4-47gv-p72v
Severity MODERATE
CVSS v3.1 Base Score 6.1
CWE Classification CWE-116: Improper Encoding or Escaping of Output
Affected Product Cryptpad
Package Ecosystem npm
Published Date
Last Updated

Security Impact

CVSS: 6.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction Required (UI:R)
Scope Changed (S:C)
Confidentiality Low (C:L)
Integrity Low (I:L)
Availability None (A:N)

How to Fix CVE-2026-26028

To remediate this vulnerability, upgrade all affected Cryptpad dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

cryptpad fixed: Latest secure release 
npm install cryptpad@Latest secure release
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls cryptpad

How to Check if You Are Affected

To determine whether your Node.js application is affected by CVE-2026-26028, inspect your project dependencies using npm:

npm ls cryptpad

Analyze the terminal output to locate any version of Cryptpad in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The npm ls cryptpad command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-116: Improper Encoding or Escaping of Output, where the product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. as a result, the intended structure of the message is not preserved. In Cryptpad, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary CryptPad’s HTML sanitizer in Diffmarked.js can be bypassed due to incomplete filtering of restricted tags. Because the sanitizer only validates the src attribute of `<iframe>` `<video>`, and `<audio>` elements, and does not restrict other attributes, an attacker can inject arbitrary HTML through srcdoc. This completely defeats CryptPad’s intended bounce sandboxing and allows link injection or other interactive content inside user-controlled documents. ### Details The sanitizer defines forbidden and restricted tags but treats <iframe> as “restricted” instead of “forbidden”: https://github.com/cryptpad/cryptpad/blob/0dd3c1f53d56dffb06651b86ead6b9b387920173/www/common/diffMarked.js#L403-L407 The actual enforcement only checks the src attribute, nothing else: https://github.com/cryptpad/cryptpad/blob/0dd3c1f53d56dffb06651b86ead6b9b387920173/www/common/diffMarked.js#L445-L449 Because only src is validated, adding a benign blob: src but malicious srcdoc results in unrestricted rendering. ### PoC An attacker can embed arbitrary HTML, including clickable external links, images, or interactive content, completely bypassing CryptPad’s bounce mechanism and sanitization: ```html <iframe src=blob: srcdoc="<a href=https://attacker.com target=_blank>CLICK ME</a>"></iframe> ``` Although CSP is strict, CryptPad exposes several same-origin gadgets that can execute attacker-controlled code. For example, `jscolor.js` dynamically evaluates user-provided options: https://github.com/cryptpad/cryptpad/blob/0dd3c1f53d56dffb06651b86ead6b9b387920173/www/common/jscolor.js#L65-L71 ### Impact Sanitizer bypass, HTML injection and potentially XSS.

CVE-2026-26028 Affected Cryptpad Versions

1 component(s)
Product / Package Ecosystem Affected Versions Fixed Version
cryptpad
npm/cryptpad
npm
≤ 5.9.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/cryptpad/cryptpad/security/advisories/GHSA-g2g4-47gv-p72v
NVD — CVE-2026-26028 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-26028
Cryptpad Source Repository REPOSITORY
https://github.com/cryptpad/cryptpad
Cryptpad Release RELEASE
https://github.com/cryptpad/cryptpad/releases/tag/2026.2.0

Frequently Asked Questions

What is CVE-2026-26028?
CVE-2026-26028 is a security vulnerability in Cryptpad involving CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS under CWE-116: Improper Encoding or Escaping of Output.
Which Cryptpad versions are affected?
Affected versions include releases prior to current release patches across affected packages: cryptpad.
What version fixes CVE-2026-26028?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
Is cryptpad affected?
Yes, cryptpad is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What is the CVSS score of CVE-2026-26028?
CVE-2026-26028 has a CVSS v3.1 base score of 6.1 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
What CWE is associated with CVE-2026-26028?
CVE-2026-26028 is classified under CWE-116: Improper Encoding or Escaping of Output (The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.).
How can I check npm dependencies for CVE-2026-26028?
Run the dependency tree command: 'npm ls cryptpad'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-g2g4-47gv-p72v",
  "modified" : "2026-05-26T19:05:10Z",
  "published" : "2026-05-26T19:05:10Z",
  "aliases" : [ "CVE-2026-26028" ],
  "summary" : "CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS",
  "details" : "### Summary\nCryptPad’s HTML sanitizer in Diffmarked.js can be bypassed due to incomplete filtering of restricted tags.\nBecause the sanitizer only validates the src attribute of `<iframe>` `<video>`, and `<audio>` elements,  and does not restrict other attributes, an attacker can inject arbitrary HTML through srcdoc. This completely defeats CryptPad’s intended bounce sandboxing and allows link injection or other interactive content inside user-controlled documents.\n\n### Details\nThe sanitizer defines forbidden and restricted tags but treats <iframe> as “restricted” instead of “forbidden”:\n\nhttps://github.com/cryptpad/cryptpad/blob/0dd3c1f53d56dffb06651b86ead6b9b387920173/www/common/diffMarked.js#L403-L407\nThe actual enforcement only checks the src attribute, nothing else:\n\nhttps://github.com/cryptpad/cryptpad/blob/0dd3c1f53d56dffb06651b86ead6b9b387920173/www/common/diffMarked.js#L445-L449\n\nBecause only src is validated, adding a benign blob: src but malicious srcdoc results in unrestricted rendering.\n### PoC\n\nAn attacker can embed arbitrary HTML, including clickable external links, images, or interactive content, completely bypassing CryptPad’s bounce mechanism and sanitization:\n\n```html\n<iframe src=blob: srcdoc=\"<a href=https://attacker.com target=_blank>CLICK ME</a>\"></iframe>\n```\n\nAlthough CSP is strict, CryptPad exposes several same-origin gadgets that can execute attacker-controlled code.\n\nFor example, `jscolor.js` dynamically evaluates user-provided options:\nhttps://github.com/cryptpad/cryptpad/blob/0dd3c1f53d56dffb06651b86ead6b9b387920173/www/common/jscolor.js#L65-L71\n\n### Impact\nSanitizer bypass, HTML injection and potentially XSS.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "cryptpad"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "5.9.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/cryptpad/cryptpad/security/advisories/GHSA-g2g4-47gv-p72v"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-26028"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/cryptpad/cryptpad"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cryptpad/cryptpad/releases/tag/2026.2.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-116", "CWE-79" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-26T19:05:10Z",
    "nvd_published_at" : "2026-05-20T20:16:36Z"
  }
}