{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/etherpad/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Etherpad Lite (1.8.14)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Etherpad"],"content_html":"\u003cp\u003eEtherpad Lite contains a stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-55090, within its HTML export functionality. The vulnerability resides in \u003ccode\u003esrc/node/utils/ExportHtml.ts\u003c/code\u003e, where the \u003ccode\u003egetHTMLFromAtext\u003c/code\u003e function fails to sanitize values interpolated from the \u003ccode\u003eexportHtmlAdditionalTagsWithData\u003c/code\u003e plugin hook. Because attribute pool values are stored verbatim when users create or edit pads, an attacker can manipulate attribute values to contain HTML injection payloads, such as \u003ccode\u003e\u0026quot; onload=\u0026quot;alert(1)\u003c/code\u003e. When the document is exported to HTML and opened by a victim in a browser, the malicious script executes within the context of the origin. This affects installations using plugins that register the hook, such as ep_font_color or ep_font_size. Defenders should prioritize updating to the patched version identified in the pull request #7905.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in arbitrary JavaScript execution in the context of the user viewing the exported HTML document. This could lead to session hijacking, unauthorized actions performed on behalf of the victim, or data exfiltration. The vulnerability impacts all Etherpad Lite environments using versions up to 1.8.14 that leverage specific plugins.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Etherpad Lite to the latest version to include the fix for CVE-2026-55090.\u003c/li\u003e\n\u003cli\u003eAudit custom Etherpad plugins that utilize the \u003ccode\u003eexportHtmlAdditionalTagsWithData\u003c/code\u003e hook to ensure they utilize the \u003ccode\u003eSecurity.escapeHTMLAttribute\u003c/code\u003e method.\u003c/li\u003e\n\u003cli\u003eRestrict access to pad creation and editing to trusted users to mitigate the risk of malicious changeset injection.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-17T18:46:31Z","date_published":"2026-08-17T18:46:31Z","id":"https://feed.craftedsignal.io/briefs/2026-08-etherpad-xss/","summary":"Etherpad Lite version 1.8.14 and earlier is vulnerable to stored XSS via the HTML export feature, allowing attackers to inject malicious payloads into attribute pool values that execute upon viewing exported documents.","title":"Stored Cross-Site Scripting in Etherpad Lite HTML Export","url":"https://feed.craftedsignal.io/briefs/2026-08-etherpad-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Etherpad","version":"https://jsonfeed.org/version/1.1"}