Executive brief
Etherpad is a real-time collaborative document editor that allows multiple users to edit documents simultaneously. When documents are exported to HTML, unescaped values from the document's attribute pool are injected directly into HTML attributes. An attacker with edit access can craft a malicious changeset that embeds JavaScript code into exported HTML, which executes in the browser of any collaborator who downloads the export, allowing session hijacking or credential theft.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in Etherpad's HTML export functionality. The getHTMLFromAtext function in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into HTML span attributes (e.g., data-color="<value>") without proper HTML attribute escaping. An authenticated pad editor can inject arbitrary attribute values through crafted changesets—only author attributes are validated, allowing any value in the attribute pool via moveOpsToNewPool → AttributePool.putAttrib. When bundled plugins like ep_font_color or ep_font_size register the hook, an attacker can use a payload such as `" onload="alert(1)` which is exported as `<span data-color="" onload="alert(1)">` and served as text/html, resulting in stored XSS. The fix (PR #7905) escapes attribute names and values using Security.escapeHTMLAttribute before export. The vulnerability affects all versions prior to 3.3.0.
Affected products
- Etherpad Etherpad <3.3.0
Timeline
- 2026-08-17: disclosed: GHSA-2jp7-wwpg-3p9w published
- 2026-06-07: patched: PR #7905 merged; patch released in version 3.3.0