Etherpad has stored XSS in HTML export via unescaped attribute-pool values
Fix: PR #7905 (ether/etherpad).
getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data-<k>="<v>" without HTML-attribute escaping. The value comes verbatim from the pad attribute pool, which a pad editor controls via a crafted changeset (only author attributes are validated; moveOpsToNewPool -> AttributePool.putAttrib stores any value). With a bundled plugin that registers the hook (ep_font_color / ep_font_size), an attribute value such as " onload="alert(1) is exported as <span data-color="" onload="alert(1)"> and served as text/html, yielding stored XSS for any collaborator who opens the export.
Fix: escape the name and value via Security.escapeHTMLAttribute. PR #7905 also adds a startup warning when default/placeholder account or SSO credentials are configured (defense-in-depth, non-breaking).
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | ep_etherpad-lite | < 3.3.0 | 3.3.0 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-79- Platform
- npm
- Package
ep_etherpad-lite- Disclosed
- 17.08.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-2jp7-wwpg-3p9w - CC BY 4.0
Vulnerability history: ep_etherpad-lite
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 6
- First → latest
- 05.2022 08.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 1
- Medium 4
Disclosures per year
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 5
-
Etherpad has stored XSS in HTML export via unescaped attribute-pool values this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.