CVE-2026-55090: XSS
Fix: PR #7905 (ether/etherpad).
getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data-<k>="<v>" without HTML-attribute escaping. The value comes verbatim from the pad attribute pool, which a pad editor controls via a crafted changeset (only author attributes are validated; moveOpsToNewPool -> AttributePool.putAttrib stores any value). With a bundled plugin that registers the hook (epfontcolor / epfontsize), an attribute value such as " onload="alert(1) is exported as <span data-color="" onload="alert(1)"> and served as text/html, yielding stored XSS for any collaborator who opens the export.
Fix: escape the name and value via Security.escapeHTMLAttribute. PR #7905 also adds a startup warning when default/placeholder account or SSO credentials are configured (defense-in-depth, non-breaking).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ep_etherpad-liteto a version that resolves this vulnerability.Fixed in 3.3.0 - Upgrade
Upgrade
ether/etherpadto a version that resolves this vulnerability.Patch PR #7905 - Configuration
Change ExportHtml.ts so that values coming from the exportHtmlAdditionalTagsWithData plugin hook are escaped using Security.escapeHTMLAttribute before being interpolated into HTML attributes; this is the fix included in PR #7905.
Etherpad HTML export (src/node/utils/ExportHtml.ts) with plugin hook exportHtmlAdditionalTagsWithData HTML-attribute escaping for interpolated attribute values = Use Security.escapeHTMLAttribute for both the attribute name and value when constructing span attributes (e.g., span data-<k>="<v>") - Operational
If default/placeholder account or SSO credentials are configured, heed the startup warning added by PR #7905 as defense-in-depth; this is non-breaking but should prompt remediation of those credential configurations.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55090?
CVE-2026-55090 has a risk score of 65, indicating a moderate vulnerability.
How do I fix CVE-2026-55090?
To fix CVE-2026-55090, ensure that the HTML attributes are properly escaped in the `getHTMLFromAtext` function.
What type of vulnerability is CVE-2026-55090?
CVE-2026-55090 is identified as an XSS (Cross-Site Scripting) vulnerability.
Which software is affected by CVE-2026-55090?
CVE-2026-55090 affects the npm package 'ep_etherpad-lite'.
When was CVE-2026-55090 published?
CVE-2026-55090 was published on August 17, 2026.