HIGH GitHub
CVE-2026-55090
Etherpad has stored XSS in HTML export via unescaped attribute-pool values
Fix: PR #7905 (ether/etherpad).
`getHTMLFromAtext` in `src/node/utils/ExportHtml.ts` interpolates values from the `exportHtmlAdditionalTagsWithData` plugin hook into `span data-<k>="<v>"` without HTML-attribute escaping. The value comes verbatim from the pad attribute pool, which a pad editor controls via a crafted changeset (only `author` attributes are validated; `moveOpsToNewPool` -> `AttributePool.putAttrib` stores any value). With a bundled plugin that registers the hook (ep_font_color / e
Affected Products
- npm/ep_etherpad-lite <= 1.8.14
References
- https://github.com/advisories/GHSA-2jp7-wwpg-3p9w
- https://github.com/ether/etherpad/security/advisories/GHSA-2jp7-wwpg-3p9w
- https://github.com/ether/etherpad/pull/7905
- https://github.com/ether/etherpad/commit/86c56cf827dd6e5ff1b6cd3760f87adc47f58bb1
This high severity vulnerability was published on 2026-08-17 via GitHub. Affected: npm/ep_etherpad-lite <= 1.8.14.
vulnfeed aggregates 11030 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.