{"id":"CVE-2026-55090","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-55090","summary":"Etherpad has stored XSS in HTML export via unescaped attribute-pool values","details":"Fix: PR #7905 (ether/etherpad).\n\n`getHTMLFromAtext` in `src/node/utils/ExportHtml.ts` interpolates values from the `exportHtmlAdditionalTagsWithData` plugin hook into `span data-<k>=\"<v>\"` without HTML-attribute escaping. The value comes verbatim from the pad attribute pool, which a pad editor controls via a crafted changeset (only `author` attributes are validated; `moveOpsToNewPool` -> `AttributePool.putAttrib` stores any value). With a bundled plugin that registers the hook (ep_font_color / ep_font_size), an attribute value such as `\" onload=\"alert(1)` is exported as `<span data-color=\"\" onload=\"alert(1)\">` and served as text/html, yielding stored XSS for any collaborator who opens the export.\n\nFix: escape the name and value via `Security.escapeHTMLAttribute`. PR #7905 also adds a startup warning when default/placeholder account or SSO credentials are configured (defense-in-depth, non-breaking).","published":"2026-08-17T17:49:38Z","modified":"2026-08-17T18:00:08.799451475Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"ep_etherpad-lite","fixedVersion":"3.3.0"}],"fix":{"url":"https://github.com/ether/etherpad/pull/7905","label":"ether/etherpad#7905"},"references":[{"type":"WEB","url":"https://github.com/ether/etherpad/security/advisories/GHSA-2jp7-wwpg-3p9w"},{"type":"WEB","url":"https://github.com/ether/etherpad/pull/7905"},{"type":"WEB","url":"https://github.com/ether/etherpad/commit/86c56cf827dd6e5ff1b6cd3760f87adc47f58bb1"},{"type":"PACKAGE","url":"https://github.com/ether/etherpad"},{"type":"WEB","url":"https://github.com/ether/etherpad/releases/tag/3.3.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-17T18:00:08.799451475Z"}}