---
id: CVE-2026-55090
title: Etherpad is a real-time collaborative editor
summary: >-
  Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext
  in src/node/utils/ExportHtml.ts interpolates values from the
  exportHtmlAdditionalTagsWithData plugin hook into span data attributes without
  HTML attribute esc…
severity: high
cwe:
  - CWE-79
vendor: ep_etherpad-lite
product: ep_etherpad-lite
affected:
  - ep_etherpad-lite <= 1.8.14
patched:
  - ep_etherpad-lite 3.3.0
published: '2026-08-19'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:15:59.613'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-55090'
references:
  - url: >-
      https://github.com/ether/etherpad/commit/86c56cf827dd6e5ff1b6cd3760f87adc47f58bb1
    label: security-advisories@github.com
  - url: 'https://github.com/ether/etherpad/pull/7905'
    label: security-advisories@github.com
  - url: 'https://github.com/ether/etherpad/releases/tag/v3.3.0'
    label: security-advisories@github.com
  - url: 'https://github.com/ether/etherpad/security/advisories/GHSA-2jp7-wwpg-3p9w'
    label: security-advisories@github.com
  - url: 'https://github.com/ether/etherpad/releases/tag/3.3.0'
  - url: 'https://github.com/advisories/GHSA-2jp7-wwpg-3p9w'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00547
epssPercentile: 0.43401
aliases:
  - GHSA-2jp7-wwpg-3p9w
ecosystem: npm
ingestedAt: '2026-08-17T17:58:10.255Z'
---

## Overview

Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value into the attribute pool through moveOpsToNewPool and AttributePool.putAttrib. When a bundled plugin such as ep_font_color or ep_font_size registers the hook, opening the resulting HTML export causes the value to execute as stored cross-site scripting in the Etherpad origin. This issue is fixed in version 3.3.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-55090)

Affected packages:

- `ep_etherpad-lite <= 1.8.14`

Patched in:

- `ep_etherpad-lite 3.3.0`

Source: https://github.com/advisories/GHSA-2jp7-wwpg-3p9w