{"id":"GHSA-2jp7-wwpg-3p9w","summary":"Etherpad has stored XSS in HTML export via unescaped attribute-pool values","details":"Fix: PR #7905 (ether/etherpad).\n\n`getHTMLFromAtext` in `src/node/utils/ExportHtml.ts` interpolates values from the `exportHtmlAdditionalTagsWithData` plugin hook into `span data-\u003ck\u003e=\"\u003cv\u003e\"` without HTML-attribute escaping. The value comes verbatim from the pad attribute pool, which a pad editor controls via a crafted changeset (only `author` attributes are validated; `moveOpsToNewPool` -\u003e `AttributePool.putAttrib` stores any value). With a bundled plugin that registers the hook (ep_font_color / ep_font_size), an attribute value such as `\" onload=\"alert(1)` is exported as `\u003cspan data-color=\"\" onload=\"alert(1)\"\u003e` and served as text/html, yielding stored XSS for any collaborator who opens the export.\n\nFix: escape the name and value via `Security.escapeHTMLAttribute`. PR #7905 also adds a startup warning when default/placeholder account or SSO credentials are configured (defense-in-depth, non-breaking).","aliases":["CVE-2026-55090"],"modified":"2026-08-17T18:11:04.673320Z","published":"2026-08-17T17:49:38Z","database_specific":{"nvd_published_at":null,"cwe_ids":["CWE-79"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-08-17T17:49:38Z"},"references":[{"type":"WEB","url":"https://github.com/ether/etherpad/security/advisories/GHSA-2jp7-wwpg-3p9w"},{"type":"WEB","url":"https://github.com/ether/etherpad/pull/7905"},{"type":"WEB","url":"https://github.com/ether/etherpad/commit/86c56cf827dd6e5ff1b6cd3760f87adc47f58bb1"},{"type":"PACKAGE","url":"https://github.com/ether/etherpad"},{"type":"WEB","url":"https://github.com/ether/etherpad/releases/tag/3.3.0"}],"affected":[{"package":{"name":"ep_etherpad-lite","ecosystem":"npm","purl":"pkg:npm/ep_etherpad-lite"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.3.0"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 1.8.14","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-2jp7-wwpg-3p9w/GHSA-2jp7-wwpg-3p9w.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}