CVE-2026-55085
CriticalCVSS 9.6Summary
Etherpad before version 3.3.1 contains an XSS vulnerability in the import functionality that allows a user with write access to a pad to store malicious markup that executes when other users, including administrators, open the pad.
Risk Assessment
Script execution in an administrator's browser could lead to session theft, data modification, or further attacks on the infrastructure.
Recommendation
Upgrade Etherpad to version 3.3.1 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in src/node/utils/ImportEtherpad.ts accepts attacker-controlled attribute-pool values from a crafted .etherpad import, including list:number1 and a malicious start value. Any user with write access to a pad can store markup that executes as cross-site scripting when another user opens the pad or /timeslider, including when an administrator views the pad. This issue is fixed in version 3.3.1.