Skip to content
OpenAdvisories

Vendor

cryptpad

4 known vulnerabilities.

Products

cryptpad 4
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.1
    CVE-2026-26028

    CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS

    CryptPad is an end-to-end encrypted collaborative office suite. In versions prior to 2026.2.0, the HTML sanitizer in Diffmarked.js can be bypassed due to incomplete attribute filtering on restricted tags. The sanitizer validates only the src attribute of <ifr…

    cryptpad cryptpad cryptpad npm