# CVE-2026-55090: Etherpad stored XSS in HTML export via unescaped attribute-pool values

Source: https://junglewise.ai/threats/cve-2026-55090-etherpad-stored-xss-in-html-export-via-unescaped-attribute-pool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55090 · Severity: high · CVSS 4 · Published 2026-08-17

Etherpad is a real-time collaborative document editor that allows multiple users to edit documents simultaneously. When documents are exported to HTML, unescaped values from the document's attribute pool are injected directly into HTML attributes. An attacker with edit access can craft a malicious changeset that embeds JavaScript code into exported HTML, which executes in the browser of any collaborator who downloads the export, allowing session hijacking or credential theft.

Technologies: [ep_etherpad-lite (npm)](https://junglewise.ai/threats/technologies/ep-etherpad-lite). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-55090 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55090 being exploited in the wild.

**How severe is CVE-2026-55090?** High severity, with a CVSS score of 4, published 17 August 2026.

**Which products and versions are affected?** Etherpad <= 1.8.14 (npm ep_etherpad-lite); also reported as <= 3.2.0 in repository advisory; ep_etherpad-lite (npm) <= 1.8.14, SEMVER:introduced=0,fixed=3.3.0.

**Is there a fix for CVE-2026-55090?** Yes. ep_etherpad-lite (npm): upgrade to 3.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55090 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55090?** Check whether you run Etherpad or ep_etherpad-lite (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ep_etherpad-lite (npm): upgrade to 3.3.0 or later

  ```sh
  npm install ep_etherpad-lite@3.3.0
  ```


## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in Etherpad's HTML export functionality. The getHTMLFromAtext function in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into HTML span attributes (e.g., data-color="<value>") without proper HTML attribute escaping. An authenticated pad editor can inject arbitrary attribute values through crafted changesets—only author attributes are validated, allowing any value in the attribute pool via moveOpsToNewPool → AttributePool.putAttrib. When bundled plugins like ep_font_color or ep_font_size register the hook, an attacker can use a payload such as `" onload="alert(1)` which is exported as `<span data-color="" onload="alert(1)">` and served as text/html, resulting in stored XSS. The fix (PR #7905) escapes attribute names and values using Security.escapeHTMLAttribute before export. The vulnerability affects all versions prior to 3.3.0.

## Affected products

- Etherpad Etherpad <3.3.0

## Identifiers

- CVE-2026-55090
- GHSA-2jp7-wwpg-3p9w

## Timeline

- 2026-08-17: disclosed: GHSA-2jp7-wwpg-3p9w published
- 2026-06-07: patched: PR #7905 merged; patch released in version 3.3.0

## References

- [https://github.com/ether/etherpad/security/advisories/GHSA-2jp7-wwpg-3p9w](https://github.com/ether/etherpad/security/advisories/GHSA-2jp7-wwpg-3p9w)
- [https://github.com/ether/etherpad/pull/7905](https://github.com/ether/etherpad/pull/7905)
- [https://github.com/ether/etherpad/commit/86c56cf827dd6e5ff1b6cd3760f87adc47f58bb1](https://github.com/ether/etherpad/commit/86c56cf827dd6e5ff1b6cd3760f87adc47f58bb1)
- [https://github.com/ether/etherpad](https://github.com/ether/etherpad)
- [https://github.com/ether/etherpad/releases/tag/3.3.0](https://github.com/ether/etherpad/releases/tag/3.3.0)

## Related threats

- [Etherpad multiple security hardening fixes](https://junglewise.ai/threats/etherpad-multiple-security-hardening-fixes-3a746766)
- [Etherpad replayable token-transfer endpoint with cleartext token exposure](https://junglewise.ai/threats/cve-2026-55088-etherpad-replayable-token-transfer-endpoint-with-cleartext-token)
- [Etherpad predictable temp file paths enable symlink-based file overwrite](https://junglewise.ai/threats/cve-2026-55086-etherpad-predictable-temp-file-paths-enable-symlink-based-file)
- [Etherpad Lite cache-poisoning XSS and open redirect via x-proxy-path header](https://junglewise.ai/threats/cve-2026-55087-etherpad-lite-cache-poisoning-xss-and-open-redirect-via-x-proxy)
- [Etherpad Lite access restriction bypass in JSONP handling](https://junglewise.ai/threats/cve-2018-6835-etherpad-lite-access-restriction-bypass-in-jsonp-handling)