npm/cryptpad CVE-2026-26028: medium 6.1, EPSS 0.24%
CryptPad has a Sanitizer Bypass in Diffmarked.js that Allows Arbitrary HTML Injection and Potential XSS
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 5.9.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-g2g4-47gv-p72v
- https://github.com/cryptpad/cryptpad/security/advisories/GHSA-g2g4-47gv-p72v
- https://nvd.nist.gov/vuln/detail/CVE-2026-26028
- https://github.com/cryptpad/cryptpad
- https://github.com/cryptpad/cryptpad/releases/tag/2026.2.0
CVE-2026-26028 · published · modified · JSON