GHSA-g2g4-47gv-p72v

Source

https://github.com/advisories/GHSA-g2g4-47gv-p72v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-g2g4-47gv-p72v/GHSA-g2g4-47gv-p72v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g2g4-47gv-p72v

Aliases

CVE-2026-26028

Published

2026-05-26T19:05:10Z

Modified

2026-06-09T05:15:08Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS

Details

Summary

CryptPad’s HTML sanitizer in Diffmarked.js can be bypassed due to incomplete filtering of restricted tags. Because the sanitizer only validates the src attribute of <iframe> <video>, and <audio> elements, and does not restrict other attributes, an attacker can inject arbitrary HTML through srcdoc. This completely defeats CryptPad’s intended bounce sandboxing and allows link injection or other interactive content inside user-controlled documents.

Details

The sanitizer defines forbidden and restricted tags but treats

Database specific

{
    "cwe_ids":  [
        "CWE-116",
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-26T19:05:10Z",
    "nvd_published_at":  "2026-05-20T20:16:36Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / cryptpad

Package

Name: cryptpad; View open source insights on deps.dev
Purl: pkg:npm/cryptpad

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

5.9.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-g2g4-47gv-p72v/GHSA-g2g4-47gv-p72v.json"