Description (CNA)
CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| cryptpad / cryptpad | affected < 2025.3.0 |
CWE
CWE-692
References
- https://github.com/cryptpad/cryptpad/security/advisories/GHSA-vq9h-x3gr-v8rj
- https://github.com/cryptpad/cryptpad/commit/d5e4830ba104a4a442cb23aab5378b8565a95607
- https://github.com/cryptpad/cryptpad/blob/15c81aa8ccb737a9a1167481f4a699af331364bb/www/bounce/main.js#L64-L95
ADP enrichment
No English description supplied.
No references supplied.