Executive brief
CryptPad, a collaborative office suite focused on privacy, contains a security flaw in its document rendering component. An attacker can bypass security filters to inject malicious content, such as deceptive links or interactive elements, into shared documents. This could lead to unauthorized actions being performed in a user's browser or the theft of sensitive information if a user interacts with a compromised document.
Technical details
A sanitizer bypass exists in CryptPad's 'Diffmarked.js' component because it incorrectly classifies the <iframe> tag as 'restricted' rather than 'forbidden'. The sanitization logic only validates the 'src' attribute for <iframe>, <video>, and <audio> elements, failing to inspect other attributes like 'srcdoc'. An attacker can exploit this by providing a benign 'src' attribute alongside a malicious 'srcdoc' payload containing arbitrary HTML. While CryptPad employs a strict Content Security Policy (CSP), the advisory notes that same-origin gadgets (such as in 'jscolor.js') could potentially be leveraged to achieve full Cross-Site Scripting (XSS). This vulnerability is tracked as CVE-2026-26028.
Affected products
- CryptPad CryptPad <= 5.9.0
Timeline
- 2026-05-20: disclosed
- 2026-05-20: advisory: NVD publication date
- 2026-05-26: advisory: GitHub Advisory published