CryptPad's Diffmarked.js sanitizer can be bypassed because it only checks the src attribute of restricted tags such as iframe, video, and audio, leaving other attributes unchecked. By supplying an innocuous src value together with a malicious srcdoc, an attacker can inject arbitrary HTML that bypasses the intended sandbox, allowing link injection and other interactive content. This flaw is an injection vulnerability that can lead to reflected or stored cross‑site scripting, compromising the confidentiality and integrity of user documents.

CryptPad releases prior to 2026.2.0, including all versions through 2026.1.x, are vulnerable. The issue resides in the Diffmarked.js component that sanitizes user‑controlled content and is present in any document stored in those earlier releases.

The CVSS score of 6.1 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker injecting crafted content into a shared document that is later opened by other users; the exploitation requires user interaction within the document viewer, but the flaw can affect many users if a document is widely shared, raising the risk of widespread XSS exposure.