{"id":"CVE-2026-55090","aliases":["GHSA-2jp7-wwpg-3p9w"],"url":"https://o3.security/vulnerability/CVE-2026-55090","summary":"Etherpad: Stored XSS in HTML export via unescaped attribute-pool values","details":"Fix: PR #7905 (ether/etherpad).\n\n`getHTMLFromAtext` in `src/node/utils/ExportHtml.ts` interpolates values from the `exportHtmlAdditionalTagsWithData` plugin hook into `span data-<k>=\"<v>\"` without HTML-attribute escaping. The value comes verbatim from the pad attribute pool, which a pad editor controls via a crafted changeset (only `author` attributes are validated; `moveOpsToNewPool` -> `AttributePool.putAttrib` stores any value). With a bundled plugin that registers the hook (ep_font_color / ep_font_size), an attribute value such as `\" onload=\"alert(1)` is exported as `<span data-color=\"\" onload=\"alert(1)\">` and served as text/html, yielding stored XSS for any collaborator who opens the export.\n\nFix: escape the name and value via `Security.escapeHTMLAttribute`. PR #7905 also adds a startup warning when default/placeholder account or SSO credentials are configured (defense-in-depth, non-breaking).","published":"2026-08-19T19:32:17.607Z","modified":"2026-09-11T03:30:41.668435485Z","cvss":null,"epss":{"score":0.00413,"percentile":0.35131,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"ep_etherpad-lite","fixedVersion":"3.3.0"}],"fix":{"url":"https://github.com/ether/etherpad/commit/86c56cf827dd6e5ff1b6cd3760f87adc47f58bb1","label":"ether/etherpad@86c56cf"},"references":[{"type":"WEB","url":"https://github.com/ether/etherpad/releases/tag/v3.3.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55090.json"},{"type":"ADVISORY","url":"https://github.com/ether/etherpad/security/advisories/GHSA-2jp7-wwpg-3p9w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55090"},{"type":"FIX","url":"https://github.com/ether/etherpad/commit/86c56cf827dd6e5ff1b6cd3760f87adc47f58bb1"},{"type":"FIX","url":"https://github.com/ether/etherpad/pull/7905"},{"type":"PACKAGE","url":"https://github.com/ether/etherpad"},{"type":"WEB","url":"https://github.com/ether/etherpad/releases/tag/3.3.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-11T03:30:41.668435485Z"}}