CVE-2026-55085

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in src/node/utils/ImportEtherpad.ts accepts attacker-controlled attribute-pool values from a crafted .etherpad import, including list:number1 and a malicious start value. Any user with write access to a pad can store markup that executes as cross-site scripting when another user opens the pad or /timeslider, including when an administrator views the pad. This issue is fixed in version 3.3.1.

• CWE-79

• https://github.com/ether/etherpad/commit/d828185efcac9abc2e46e6da1c171393500fa319
• https://github.com/ether/etherpad/pull/7937
• https://github.com/ether/etherpad/releases/tag/v3.3.1
• https://github.com/ether/etherpad/security/advisories/GHSA-f7h5-v9hm-548j
• https://github.com/ether/etherpad/security/advisories/GHSA-f7h5-v9hm-548j

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55078Coder allows organizations to provision remote development e…6.5
• CVE-2026-55079Coder allows organizations to provision remote development e…6.5
• CVE-2026-5508The WowPress plugin for WordPress is vulnerable to Stored Cr…6.4
• CVE-2026-55081DHIS2 is a flexible information system for data capture, man…7.3
• CVE-2026-55082DHIS2 is a flexible information system for data capture, man…8.7
• CVE-2026-55084DHIS2 is a flexible information system for data capture, man…8.8
• CVE-2026-55086Etherpad is a real-time collaborative editor. Prior to 3.1.0…4.2
• CVE-2026-55087Etherpad is a real-time collaborative editor. From 2.1.0 unt…6.1
• CVE-2026-55088Etherpad is a real-time collaborative editor. From 2.6.0 unt…6.8
• CVE-2026-55089Etherpad is a real-time collaborative editor. From 2.1.0 unt…9.9
• CVE-2026-5509An authenticated command injection vulnerability exists in t…7.2
• CVE-2026-55090Etherpad is a real-time collaborative editor. Prior to 3.3.0…5.3