CVE-2026-55085: Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite
Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in src/node/utils/ImportEtherpad.ts accepts attacker-controlled attribute-pool values from a crafted .etherpad import, including list:number1 and a malicious start value. Any user with write access to a pad can store markup that executes as cross-site scripting when another user opens the pad or /timeslider, including when an administrator views the pad. This issue is fixed in version 3.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
etherpad/etherpad-liteto a version that resolves this vulnerability.Fixed in 3.3.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Etherpad instances running versions before 3.3.1 are exposed when users can write to pads and another user later opens an affected pad or its /timeslider view. Administrators are also affected if they view a malicious pad.
What does an attacker need to exploit it?
An attacker needs write access to a pad and must import a crafted .etherpad file containing attacker-controlled attribute-pool values, including list:number1 with a malicious start value. Exploitation then requires another user to open the pad or /timeslider.
Is a default Etherpad installation affected?
The issue affects Etherpad versions prior to 3.3.1, but exploitation depends on an attacker being able to write to a pad and import a crafted .etherpad file. The provided information does not establish whether those conditions are enabled by default.
What can be done if upgrading is not immediately possible?
Restrict pad write access and prevent untrusted users from importing .etherpad files. Avoid opening pads or /timeslider views containing untrusted imported content, especially from administrator accounts.
How can I determine whether a pad may already be affected?
Review pads that were created or modified through .etherpad imports by untrusted writers, particularly imports containing list:number1 attribute-pool values with unusual start values. Opening a suspected pad or its /timeslider can trigger the stored script, so investigation should avoid privileged accounts.