CVE-2026-55090 in Etherpad
Summary
by MITRE • 08/19/2026
Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value into the attribute pool through moveOpsToNewPool and AttributePool.putAttrib. When a bundled plugin such as ep_font_color or ep_font_size registers the hook, opening the resulting HTML export causes the value to execute as stored cross-site scripting in the Etherpad origin. This issue is fixed in version 3.3.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified involves a Stored Cross-Site Scripting (XSS) flaw within the real-time collaborative editing platform Etherpad, specifically affecting versions prior to 3.3.0. The core technical deficiency resides in the getHTMLFromAtext function located in src/node/utils/ExportHtml.ts. This component is responsible for generating HTML exports of document content and interacts with a plugin hook system known as exportHtmlAdditionalTagsWithData. When plugins such as ep_font_color or ep_font_size register this hook, they inject custom data attributes into span elements within the exported HTML structure. The critical failure occurs because these injected values are interpolated directly into the HTML output without undergoing proper attribute escaping. This lack of sanitization allows malicious payloads to persist in the rendered DOM when an administrator or user views the export file.
The exploitation path begins with a pad editor who can manipulate the internal state of the document through specific API calls, namely moveOpsToNewPool and AttributePool.putAttrib. These functions allow for the insertion of arbitrary values into the attribute pool that backs the text formatting metadata. By carefully crafting these operations, an attacker can inject script-containing strings as part of standard font or color attributes. Because Etherpad treats this data as trusted when generating exports, the malicious payload is stored within the document structure itself rather than being executed immediately during editing. This persistence mechanism classifies the vulnerability as Stored XSS, meaning the attack does not require immediate user interaction with a crafted link but instead waits for another party to trigger the export functionality.
The operational impact of this vulnerability is significant due to its potential for automated or social engineering-driven exploitation. Once an attacker has injected their payload into a pad, any subsequent action that triggers an HTML export will cause the browser to execute the embedded JavaScript within the context of the Etherpad origin. This session-based execution environment allows the malicious script to access cookies, local storage, and other sensitive data associated with the user viewing the export. An adversary could leverage this capability to hijack administrative sessions, deface content by modifying document attributes via API calls from the browser context, or redirect users to phishing sites that mimic the Etherpad interface. The severity is compounded by the fact that legitimate plugins are involved in the rendering process, making it difficult for end-users to distinguish between normal formatting exports and maliciously crafted ones without inspecting the underlying HTML source code.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under the sub-category of Stored XSS where untrusted data is saved by a web application and later displayed to other users in a way that allows malicious scripts to execute. In terms of offensive security frameworks, this behavior maps to MITRE ATT&CK technique T1059, Command and Scripting Interpreter, as it enables the execution of arbitrary code within the victim's browser environment. It also relates to T1204, User Execution, since the attack relies on a user opening or exporting the compromised document to trigger the payload delivery.
Mitigation strategies must prioritize immediate version upgrades for all deployed instances. Organizations running Etherpad should upgrade to version 3.3.0 or later, where this interpolation flaw has been resolved through improved input validation and output encoding practices. For environments that cannot immediately patch due to dependency constraints, temporary mitigations include disabling the specific plugins mentioned in the advisory if they are not strictly necessary for operations. Additionally, implementing a Content Security Policy (CSP) with strict script-src directives can help mitigate the impact of any remaining XSS vectors by preventing inline script execution and restricting sources from which scripts may be loaded. Regular security audits focusing on plugin hook implementations and HTML export mechanisms should also be conducted to ensure that future developments adhere to secure coding standards regarding input sanitization and output encoding.