CVE-2026-26028 Overview
CVE-2026-26028 is a Cross-Site Scripting (XSS) vulnerability in CryptPad, an end-to-end encrypted collaborative office suite. The flaw resides in the HTML sanitizer implemented in Diffmarked.js. The sanitizer validates only the src attribute on restricted tags such as <iframe>, <video>, and <audio>, leaving all other attributes unchecked. An attacker can inject arbitrary HTML via the srcdoc attribute, bypassing CryptPad's bounce sandboxing. This enables link injection and other interactive content rendering inside user-controlled documents. The issue affects all versions prior to 2026.2.0 and is tracked under [CWE-79].
Critical Impact
Attackers can bypass CryptPad's HTML sanitizer to inject arbitrary content via iframe srcdoc, defeating sandboxing and enabling XSS-style attacks against collaborators viewing crafted documents.
Affected Products
- CryptPad versions prior to 2026.2.0
- Diffmarked.js HTML sanitizer component
- Any deployment rendering user-supplied HTML via the affected sanitizer
Discovery Timeline
- 2026-05-20 - CVE CVE-2026-26028 published to NVD
- 2026-05-20 - Last updated in NVD database
Technical Details for CVE-2026-26028
Vulnerability Analysis
The vulnerability stems from incomplete attribute filtering in the Diffmarked.js HTML sanitizer. CryptPad maintains two tag classifications: forbidden and restricted. Forbidden tags are stripped entirely, while restricted tags are permitted under attribute-level controls. The sanitizer categorizes <iframe> as restricted rather than forbidden. Enforcement logic then inspects only the src attribute on these elements. All other attributes pass through without validation. This selective inspection misses the srcdoc attribute, which itself can contain arbitrary HTML and inline scripts rendered inside the iframe document context.
Root Cause
The root cause is a misclassification combined with attribute-allowlist incompleteness. By treating <iframe> as restricted instead of forbidden, the sanitizer relies on attribute filtering to enforce safety. The filtering implementation only checks src, ignoring srcdoc, sandbox, allow, and other attributes that can influence iframe behavior. Pairing a benign blob: URL in src with a malicious srcdoc payload satisfies the src check while delivering attacker-controlled HTML to the renderer.
Attack Vector
Exploitation requires an attacker to author or modify a CryptPad document containing a crafted <iframe srcdoc="..."> payload. When another user opens or previews the document, the sanitizer permits the iframe because its src passes inspection. The browser then renders the srcdoc content in a nested document context, executing attacker-supplied markup. The attack vector is network-based and requires user interaction to view the malicious document. Successful exploitation enables link injection, phishing overlays, and other interactive content that circumvents CryptPad's bounce sandboxing model.
No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-g2g4-47gv-p72v for upstream technical details.
Detection Methods for CVE-2026-26028
Indicators of Compromise
- CryptPad documents containing <iframe> elements with a populated srcdoc attribute
- Iframe src values using blob: schemes paired with non-empty srcdoc content
- Unexpected outbound link rendering or phishing-style overlays within rendered pads
Detection Strategies
- Audit stored pad content for <iframe, <video>, and <audio> tags with attributes other than src
- Inspect server logs for document edits that introduce iframe markup from unexpected accounts
- Add Content Security Policy (CSP) reporting to capture frame-src and script-src violations triggered by sandboxed iframe content
Monitoring Recommendations
- Monitor CryptPad version strings exposed by the server and alert on instances running below 2026.2.0
- Track collaborator activity on shared pads for sudden HTML payload additions
- Review browser console errors and CSP violation reports from end-user sessions accessing shared documents
How to Mitigate CVE-2026-26028
Immediate Actions Required
- Upgrade all CryptPad instances to version 2026.2.0 or later as published in the GitHub Release 2026.2.0
- Notify users of self-hosted instances and require document re-review after upgrade
- Audit recently modified pads for iframe markup containing srcdoc attributes
Patch Information
The maintainers fixed the issue in CryptPad 2026.2.0. The patch reclassifies <iframe> handling and expands attribute filtering on restricted tags to cover srcdoc and related vectors. Full details are available in the GitHub Security Advisory GHSA-g2g4-47gv-p72v.
Workarounds
- If immediate upgrade is not possible, restrict pad creation and editing to trusted users only
- Deploy a strict Content Security Policy that disallows inline scripts and limits frame-src to known origins
- Disable or hide pad types that render Markdown or rich HTML through the affected sanitizer until the patch is applied
# Configuration example: upgrade a self-hosted CryptPad deployment
git fetch --tags
git checkout 2026.2.0
npm ci
npm run install:components
systemctl restart cryptpad
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
