CVE-2026-55090
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Etherpad, a real-time collaborative editor, prior to version 3.3.0 has a stored XSS vulnerability in getHTMLFromAtext where values from the exportHtmlAdditionalTagsWithData plugin hook are interpolated into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value into the attribute pool, and opening the HTML export executes the script in the Etherpad origin.
Risk Assessment
The risk includes session hijacking, data theft, or unauthorized actions in the application context. The attack requires user interaction with the HTML export.
Recommendation
Upgrade Etherpad to version 3.3.0 or later. Also, avoid opening HTML exports from untrusted sources and consider adding security headers.
Original NVD description (English source)
Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value into the attribute pool through moveOpsToNewPool and AttributePool.putAttrib. When a bundled plugin such as ep_font_color or ep_font_size registers the hook, opening the resulting HTML export causes the value to execute as stored cross-site scripting in the Etherpad origin. This issue is fixed in version 3.3.0.