EUVD-2026-62740Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Default Etherpad allows anonymous pad writes (PR:N); a victim must open the pad (UI:R); script escapes into another user's/admin session (S:C) with high confidentiality and integrity impact and limited availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Lifecycle Timeline
4DescriptionCVE.org
Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in src/node/utils/ImportEtherpad.ts accepts attacker-controlled attribute-pool values from a crafted .etherpad import, including list:number1 and a malicious start value. Any user with write access to a pad can store markup that executes as cross-site scripting when another user opens the pad or /timeslider, including when an administrator views the pad. This issue is fixed in version 3.3.1.
AnalysisAI
Stored cross-site scripting in Etherpad before 3.3.1 lets any user with write access to a pad execute arbitrary JavaScript in the browser of anyone - including an administrator - who later opens the pad or its /timeslider view. The root cause is the numbered-list rendering path interpolating an attacker-controlled ordered-list 'start' value, sourced from a crafted .etherpad import, directly into unquoted markup assigned to innerHTML. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) write access to a pad - anonymous on default Etherpad configurations, but restricted to authenticated users on instances that enforce login for editing; (2) the ability to submit a crafted .etherpad import so setPadRaw ingests a malicious attribute-pool entry (list:number1 with a chosen start), meaning the import feature must be reachable; (3) a space-free start value to satisfy the sink's \S+ capture (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The source CVSS 3.1 score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L), reflecting network reach, low complexity, a scope change (script runs in a victim/admin browser context), and the requirement that a victim open the pad. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with write access to a pad (anonymous by default on an unhardened instance) imports a crafted .etherpad file whose attribute pool defines a numbered-list line with a start value of 1><svg/onload=alert(document.domain)>. The value is stored and, when a moderator or administrator later opens the pad or the /timeslider replay view, the browser parses the injected markup and runs the attacker's JavaScript in that privileged session. … |
| Remediation | Vendor-released patch: upgrade to Etherpad 3.3.1, which coerces the ordered-list start value to an integer and HTML-escapes it before rendering (fix commit d828185efcac9abc2e46e6da1c171393500fa319 via PR https://github.com/ether/etherpad/pull/7937; advisory https://github.com/ether/etherpad/security/advisories/GHSA-f7h5-v9hm-548j). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Etherpad deployments in use and verify their current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An Argument Injection issue in the plugin management of Etherpad 1.8.13 allows privileged users to execute arbitrary cod
A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary
Privilege escalation to administrative API access in Etherpad 2.1.0 through 3.0.x lets any authenticated non-admin OAuth
Etherpad 1.6.3 before 1.6.4 allows an attacker to execute arbitrary code. Rated critical severity (CVSS 9.8), this vulne
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass
Etherpad is a real-time collaborative editor. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to rea
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to execute arbitrary code on the server. Rated high severity (C
Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1. Rated high sev
Etherpad 1.5.x and 1.6.x before 1.6.4 allows an attacker to export all the existing pads of an instance without knowledg
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today