CVE-2026-55090
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Etherpad, a real-time collaborative editor, prior to version 3.3.0 has a stored XSS vulnerability in getHTMLFromAtext where values from the exportHtmlAdditionalTagsWithData plugin hook are interpolated into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value into the attribute pool, and opening the HTML export executes the script in the Etherpad origin.
Risk Assessment
The risk includes session hijacking, data theft, or unauthorized actions in the application context. The attack requires user interaction with the HTML export.
Recommendation
Upgrade Etherpad to version 3.3.0 or later. Also, avoid opening HTML exports from untrusted sources and consider adding security headers.
Other vulnerabilities in Etherpad
See all- CVE-2026-55089Critical
Etherpad from version 2.1.0 to 3.1.0 contains an authorization vulnerability in the API that allows a non-admin user with a valid token to invoke administrative functions such as modifying, deleting, or disclosing pads.
- CVE-2026-55085Critical
Etherpad before version 3.3.1 contains an XSS vulnerability in the import functionality that allows a user with write access to a pad to store malicious markup that executes when other users, including administrators, open the pad.
- CVE-2026-55088Medium
Etherpad versions 2.6.0 to 3.1.0 have a vulnerability in the token transfer mechanism where an author token is stored and exposed via GET /tokenTransfer/{uuid} without expiration or removal after redemption. An unauthenticated attacker who obtains the UUID can repeatedly redeem it, receive fresh author cookies, and impersonate the author.
- CVE-2026-55087Medium
Etherpad versions 2.1.0 to 3.1.0 use the attacker-controlled x-proxy-path header when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary, or Cache-Control. A shared proxy or CDN can cache the response and serve attacker-injected script to an administrator. Version 3.0.0 also accepts a protocol-relative x-proxy-path value, allowing redirection to an attacker-controlled host.
- CVE-2026-55086Medium
Etherpad prior to version 3.1.0 generates temporary filenames using Math.random() and places them in the system temp directory. A local attacker who predicts the filename can create a symbolic link to a file writable by the Etherpad process, allowing overwrite with partially attacker-controlled content during import or export.
Original NVD description (English source)
Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value into the attribute pool through moveOpsToNewPool and AttributePool.putAttrib. When a bundled plugin such as ep_font_color or ep_font_size registers the hook, opening the resulting HTML export causes the value to execute as stored cross-site scripting in the Etherpad origin. This issue is fixed in version 3.3.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS