CVE-2026-55090: Etherpad Stored XSS Vulnerability

CVE-2026-55090 Overview

CVE-2026-55090 is a stored cross-site scripting (XSS) vulnerability in Etherpad, a widely deployed real-time collaborative editor. The flaw resides in getHTMLFromAtext within src/node/utils/ExportHtml.ts. Prior to version 3.3.0, Etherpad interpolates values returned by the exportHtmlAdditionalTagsWithData plugin hook directly into span data attributes without HTML attribute escaping. A pad editor can inject attacker-controlled values into the attribute pool through moveOpsToNewPool and AttributePool.putAttrib. When bundled plugins such as ep_font_color or ep_font_size register the hook, opening the exported HTML executes the payload in the Etherpad origin.

Critical Impact
Any user with pad-editing rights can plant stored JavaScript that executes for anyone opening the HTML export in the Etherpad origin, enabling session theft and account takeover.

Affected Products

Etherpad versions prior to 3.3.0
Etherpad instances running bundled plugins that implement exportHtmlAdditionalTagsWithData (for example ep_font_color, ep_font_size)
HTML export functionality served from the Etherpad origin

Discovery Timeline

2026-08-19 - CVE-2026-55090 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-55090

Vulnerability Analysis

The vulnerability is a stored cross-site scripting weakness classified under [CWE-79]. Etherpad's export routine constructs HTML strings by concatenating plugin-supplied values into data-* attributes on span elements. Because the values pass through unescaped, an attacker can terminate the attribute quote and inject arbitrary HTML or JavaScript.

Exploitation requires only that the target open the exported HTML in a browser session tied to the Etherpad origin. The injected script inherits full same-origin privileges, allowing the attacker to read pad contents, hijack session cookies not protected by HttpOnly, and issue authenticated requests on behalf of the victim.

The EPSS score is 0.54% with a percentile of 43.164, reflecting current predicted exploitation likelihood.

Root Cause

The root cause is missing output encoding at the attribute-context boundary. In pre-3.3.0 code, getHTMLFromAtext executes the plugin hook and pushes each returned key/value pair into the tag list using template literals: `span data-${prop[0]}="${prop[1]}"`. Neither the attribute name nor the attribute value is sanitized. Because attribute names are also interpolated, an attacker can break out of the intended data-* naming scheme entirely.

Attack Vector

A pad editor authors content that includes crafted formatting attributes (color, font size, or any attribute a hook plugin surfaces). The malicious value is stored in the pad's attribute pool via moveOpsToNewPool and AttributePool.putAttrib. When another user exports the pad to HTML and opens the file, the browser parses the malformed span tag and executes the attacker's script in the Etherpad origin. User interaction is required to trigger the payload, which is reflected in the CVSS 4.0 metrics.

typescript

     // like <span data-tag="value">
     hooks.aCallAll('exportHtmlAdditionalTagsWithData', pad).then((newProps: string[]) => {
       newProps.forEach((prop) => {
-        tags.push(`span data-${prop[0]}="${prop[1]}"`);
+        // Attribute names/values here originate from the pad's attribute pool
+        // (user content), so escape the value and constrain the data-* name
+        // before interpolating, consistent with the escaping already applied to
+        // exported URLs and text below.
+        const dataName = String(prop[0]).replace(/[^a-zA-Z0-9_-]/g, '');
+        tags.push(`span data-${dataName}="${Security.escapeHTMLAttribute(String(prop[1]))}"`);
         props.push(prop);
       });
     }),

Source: GitHub Commit 86c56cf

Detection Methods for CVE-2026-55090

Indicators of Compromise

Exported HTML files from Etherpad containing <span> elements with unexpected attribute names or embedded event handlers such as onerror, onload, or onmouseover.
Attribute pool entries containing quote characters ("), angle brackets (<, >), or the substring javascript: in font-color, font-size, or other plugin-managed attributes.
Unexpected outbound HTTP requests from clients shortly after opening a pad HTML export.

Detection Strategies

Inventory Etherpad instances and identify those running versions below 3.3.0 with bundled plugins that implement exportHtmlAdditionalTagsWithData.
Scan stored pad content and attribute pools for values that contain HTML metacharacters in attributes owned by ep_font_color, ep_font_size, or similar hook consumers.
Compare exported HTML output against expected patterns; any attribute name outside [a-zA-Z0-9_-] after the data- prefix indicates tampering.

Monitoring Recommendations

Log and review pad edits that introduce non-standard color or size attribute values, particularly from newly registered accounts.
Enable a strict Content Security Policy (CSP) on Etherpad and alert on CSP violation reports referencing inline script execution.
Forward Etherpad application logs to a centralized store and monitor for anomalous export activity following suspicious edits.

How to Mitigate CVE-2026-55090

Immediate Actions Required

Upgrade all Etherpad instances to version 3.3.0 or later, which applies HTML attribute escaping in getHTMLFromAtext.
Audit pads created or modified before the upgrade for injected attribute values and purge malicious content from the attribute pool.
Rotate session cookies and administrative credentials if there is evidence any user opened a suspicious HTML export.

Patch Information

The fix is included in Etherpad 3.3.0. The patch escapes plugin-supplied values with Security.escapeHTMLAttribute and constrains data-* attribute names to [a-zA-Z0-9_-]. See the GitHub Security Advisory GHSA-2jp7-wwpg-3p9w, Pull Request #7905, and the v3.3.0 release notes for full details.

Workarounds

Disable bundled plugins that register exportHtmlAdditionalTagsWithData, including ep_font_color and ep_font_size, until the upgrade is applied.
Restrict pad-editing privileges to trusted users and require authentication before granting write access.
Deploy a Content Security Policy that forbids inline scripts and restricts script sources to reduce the impact of any successful injection.

bash

# Upgrade Etherpad to the patched release
git fetch --tags
git checkout v3.3.0
pnpm install
pnpm run build
# Restart the Etherpad service after upgrade
systemctl restart etherpad