CVE-2026-55090

Received Received - Intake

Stored XSS in Etherpad HTML Export via Plugin Hook

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value into the attribute pool through moveOpsToNewPool and AttributePool.putAttrib. When a bundled plugin such as ep_font_color or ep_font_size registers the hook, opening the resulting HTML export causes the value to execute as stored cross-site scripting in the Etherpad origin. This issue is fixed in version 3.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-19

Generated

2026-08-20

AI Q&A

2026-08-20

EPSS Evaluated

N/A

NVD

CVE-2026-55090

EUVD

EUVD-2026-62734

Affected Vendors & Products

Vendor	Product	Version / Range
etherpad	etherpad	to 3.3.0 (exc)
ether	etherpad	to 3.3.0 (exc)
ether	etherpad	3.3.0
ether	ep_etherpad_lite	to 3.3.0 (exc)
ether	ep_etherpad_lite	3.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Etherpad's HTML export feature. It occurs because the getHTMLFromAtext function interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without proper HTML attribute escaping. An attacker can manipulate the attribute pool to inject malicious JavaScript code, which executes when the exported HTML is viewed.

Detection Guidance

Check Etherpad version with: curl -s https://your-etherpad-instance.com/admin/plugins | grep version. If version is below 3.3.0, the system is vulnerable. Inspect HTML exports for unescaped data attributes in span elements. Look for logs indicating default credentials like 'admin', 'password', or 'changeme'.

Impact Analysis

An attacker could execute arbitrary JavaScript in the context of the Etherpad origin when a user views an exported HTML file. This could lead to session hijacking, data theft, or unauthorized actions on behalf of the user. The attack requires a pad editor to place malicious content and a vulnerable plugin like ep_font_color or ep_font_size.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable Etherpad versions may face compliance violations if user data is compromised through this XSS flaw.

Mitigation Strategies

Upgrade Etherpad to version 3.3.0 or later. Review and replace default credentials for all accounts and SSO clients. Enable HTML attribute escaping in plugin hooks. Monitor logs for default credential warnings and address them immediately.

Hi! I’m here to help you understand CVE-2026-55090. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70