EUVD-2026-62734
GHSA-2jp7-wwpg-3p9w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no privileges required on default open-pad instances; UI:R because the victim must open the HTML export; S:C for cross-user XSS scope; C:L and I:L for browser-context script execution.
Primary rating from Vendor (https://github.com/ether/etherpad).
CVSS VectorVendor: https://github.com/ether/etherpad
Lifecycle Timeline
4DescriptionCVE.org
Fix: PR #7905 (ether/etherpad).
getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data-<k>="<v>" without HTML-attribute escaping. The value comes verbatim from the pad attribute pool, which a pad editor controls via a crafted changeset (only author attributes are validated; moveOpsToNewPool -> AttributePool.putAttrib stores any value). With a bundled plugin that registers the hook (ep_font_color / ep_font_size), an attribute value such as " onload="alert(1) is exported as <span data-color="" onload="alert(1)"> and served as text/html, yielding stored XSS for any collaborator who opens the export.
Fix: escape the name and value via Security.escapeHTMLAttribute. PR #7905 also adds a startup warning when default/placeholder account or SSO credentials are configured (defense-in-depth, non-breaking).
AnalysisAI
Stored XSS in Etherpad's HTML export function allows any pad editor to execute arbitrary JavaScript in the browser of every collaborator who opens the exported document. The root cause is in getHTMLFromAtext (src/node/utils/ExportHtml.ts), where attribute-pool values routed through the exportHtmlAdditionalTagsWithData plugin hook are interpolated directly into span data-attributes without HTML escaping - reachable via the bundled ep_font_color or ep_font_size plugins. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must be simultaneously satisfied: (1) The attacker must have write access to a target Etherpad pad - on public or open Etherpad instances this is available without any credentials, while private instances require at least a collaborator account or invite link; (2) A plugin registering the `exportHtmlAdditionalTagsWithData` hook must be installed and active, specifically ep_font_color or ep_font_size, both of which are bundled with standard Etherpad distributions - without this hook being registered, the vulnerable interpolation code is never invoked and exploitation is impossible regardless of version; (3) A victim must actively open the HTML export of the affected pad, meaning exploitation is not passive - the attacker cannot trigger the XSS remotely without the export action. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate to high for any multi-user or public-facing Etherpad instance where ep_font_color or ep_font_size plugins are active. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Etherpad to version 3.3.0 or later, available at https://github.com/ether/etherpad/releases/tag/3.3.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Etherpad instances in production and notify users to halt HTML exports until patching completes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today