CVE-2026-55085

Received Received - Intake

Cross-Site Scripting in Etherpad via Malicious List Start Attribute

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in src/node/utils/ImportEtherpad.ts accepts attacker-controlled attribute-pool values from a crafted .etherpad import, including list:number1 and a malicious start value. Any user with write access to a pad can store markup that executes as cross-site scripting when another user opens the pad or /timeslider, including when an administrator views the pad. This issue is fixed in version 3.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-55085

EUVD

EUVD-2026-62740

Affected Vendors & Products

Vendor	Product	Version / Range
etherpad	etherpad	to 3.3.1 (inc)
ether	etherpad	to 3.3.1 (inc)
ether	etherpad	to 3.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-55085 is a stored cross-site scripting (XSS) vulnerability in Etherpad versions 3.3.0 and earlier. It allows attackers with write access to a pad to inject malicious JavaScript by crafting a specially formatted .etherpad file with a malicious start attribute value in a numbered list. The unescaped start attribute in the <ol> tag enables script execution when the pad is viewed by others, including administrators.

Detection Guidance

To detect this vulnerability, check the Etherpad version installed on your system. Run commands like 'npm list etherpad' or 'etherpad --version' to verify if the version is below 3.3.1. Inspect pad content for malformed numbered lists with suspicious start attributes, such as values containing HTML or JavaScript payloads.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in the context of victims' sessions. Impact includes reading or modifying pad content, stealing session cookies or tokens, performing authenticated requests on behalf of victims, and potentially chaining to remote code execution if an administrator views the compromised pad. Exploitation requires only write access to a pad.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data stored in pads, violating confidentiality requirements under GDPR and HIPAA. The ability to execute scripts in privileged contexts may result in data breaches, unauthorized modifications, or exfiltration of protected health or personal information, potentially leading to regulatory penalties.

Mitigation Strategies

Immediately upgrade Etherpad to version 3.3.1 or later. Disable anonymous write access if enabled by setting requireAuthentication to true. Review and sanitize any imported .etherpad files for malicious attributes. Monitor pads for unusual activity or unauthorized changes.

Hi! I’m here to help you understand CVE-2026-55085. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70