Etherpad CVE-2026-55085

Requires (1) write access to a pad - anonymous on default Etherpad configurations, but restricted to authenticated users on instances that enforce login for editing; (2) the ability to submit a crafted .etherpad import so setPadRaw ingests a malicious attribute-pool entry (list:number1 with a chosen start), meaning the import feature must be reachable; (3) a space-free start value to satisfy the sink's \S+ capture (e.g. 1><svg/onload=...>); and (4) a victim, notably an administrator, subsequently opening the affected pad or its /timeslider view (UI:R). Limiting factors: exploitation is per-victim (each targeted user must view the pad), instances that disable import or gate write access with authentication materially reduce exposure, and versions 3.3.1 and later are not vulnerable.

The source CVSS 3.1 score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L), reflecting network reach, low complexity, a scope change (script runs in a victim/admin browser context), and the requirement that a victim open the pad. Note a tension worth verifying: the vector uses PR:N (unauthenticated) while the description states 'any user with write access to a pad' must store the payload - this is reconcilable because default Etherpad deployments allow anonymous pad editing, but hardened instances that gate write access behind authentication effectively raise the bar to PR:L, so real-world risk depends on deployment. No EPSS score, KEV listing, or SSVC decision data was provided, so exploitation probability and automatability cannot be quantified from the input. There is no public exploit identified at time of analysis and no evidence of active exploitation; however, the impact is genuinely high because a low-privileged pad editor can escalate to full compromise of an administrator's session. This is a real priority for any multi-user or public Etherpad instance, especially where import is enabled.

An attacker with write access to a pad (anonymous by default on an unhardened instance) imports a crafted .etherpad file whose attribute pool defines a numbered-list line with a start value of 1><svg/onload=alert(document.domain)>. The value is stored and, when a moderator or administrator later opens the pad or the /timeslider replay view, the browser parses the injected markup and runs the attacker's JavaScript in that privileged session. The vendor's own regression test demonstrates exactly this payload, so a working proof-of-concept effectively exists in the fix commit even though no separate public exploit was catalogued.