Is CVE-2026-55090 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55090 being exploited in the wild.

How severe is CVE-2026-55090?

High severity, with a CVSS score of 4, published 17 August 2026.

Which products and versions are affected?

Etherpad <= 1.8.14 (npm ep_etherpad-lite); also reported as <= 3.2.0 in repository advisory; ep_etherpad-lite (npm) <= 1.8.14, SEMVER:introduced=0,fixed=3.3.0.

Is there a fix for CVE-2026-55090?

Yes. ep_etherpad-lite (npm): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55090 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55090?

Check whether you run Etherpad or ep_etherpad-lite (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55090: Etherpad stored XSS in HTML export via unescaped attribute-pool values

Q: Which products and versions are affected?

Etherpad <= 1.8.14 (npm ep_etherpad-lite); also reported as <= 3.2.0 in repository advisory; ep_etherpad-lite (npm) <= 1.8.14, SEMVER:introduced=0,fixed=3.3.0.

Q: Is there a fix for CVE-2026-55090?

Yes. ep_etherpad-lite (npm): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55090 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-55090?

Check whether you run Etherpad or ep_etherpad-lite (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55090 · Severity: high · CVSS 4 · Published 2026-08-17

Etherpad is a real-time collaborative document editor that allows multiple users to edit documents simultaneously. When documents are exported to HTML, unescaped values from the document's attribute pool are injected directly into HTML attributes. An attacker with edit access can craft a malicious changeset that embeds JavaScript code into exported HTML, which executes in the browser of any collaborator who downloads the export, allowing session hijacking or credential theft.

Technologies: ep_etherpad-lite (npm). Vendors: npm.

Quick answers

Is CVE-2026-55090 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55090 being exploited in the wild.
How severe is CVE-2026-55090?: High severity, with a CVSS score of 4, published 17 August 2026.
Which products and versions are affected?: Etherpad <= 1.8.14 (npm ep_etherpad-lite); also reported as <= 3.2.0 in repository advisory; ep_etherpad-lite (npm) <= 1.8.14, SEMVER:introduced=0,fixed=3.3.0.
Is there a fix for CVE-2026-55090?: Yes. ep_etherpad-lite (npm): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55090 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55090?: Check whether you run Etherpad or ep_etherpad-lite (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

ep_etherpad-lite (npm): upgrade to 3.3.0 or later
```
npm install ep_etherpad-lite@3.3.0
```

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in Etherpad's HTML export functionality. The getHTMLFromAtext function in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into HTML span attributes (e.g., data-color="<value>") without proper HTML attribute escaping. An authenticated pad editor can inject arbitrary attribute values through crafted changesets—only author attributes are validated, allowing any value in the attribute pool via moveOpsToNewPool → AttributePool.putAttrib. When bundled plugins like ep_font_color or ep_font_size register the hook, an attacker can use a payload such as `" onload="alert(1)` which is exported as `<span data-color="" onload="alert(1)">` and served as text/html, resulting in stored XSS. The fix (PR #7905) escapes attribute names and values using Security.escapeHTMLAttribute before export. The vulnerability affects all versions prior to 3.3.0.

Affected products

Etherpad Etherpad <3.3.0

Identifiers

CVE-2026-55090
GHSA-2jp7-wwpg-3p9w

Timeline

2026-08-17: disclosed: GHSA-2jp7-wwpg-3p9w published
2026-06-07: patched: PR #7905 merged; patch released in version 3.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.