Description

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in src/node/utils/ImportEtherpad.ts accepts attacker-controlled attribute-pool values from a crafted .etherpad import, including list:number1 and a malicious start value. Any user with write access to a pad can store markup that executes as cross-site scripting when another user opens the pad or /timeslider, including when an administrator views the pad. This issue is fixed in version 3.3.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-19T20:17:17.280Z",
  "pubdate": "2026-08-19T20:17:17.280Z",
  "executiveSummary": "A cross-site scripting (XSS) vulnerability exists in Etherpad prior to version 3.3.1. The flaw resides in the handling of numbered list attributes during document rendering and import processes.\nAn authenticated user with write access to a pad can exploit this vulnerability by supplying a crafted .etherpad import containing malicious attribute-pool values.\nWhen another user, including an administrator, opens the affected pad or accesses the /timeslider endpoint, the injected markup executes arbitrary script code within the context of the victim's session.\nThe risk implication is severe, as successful exploitation compromises session integrity and allows attackers to execute arbitrary JavaScript within the application scope of other users viewing the collaborative document.\nExploitation requires write access to a pad and the ability to import or store malicious markup via the attribute pool.",
  "technicalDetails": "The vulnerability is rooted in improper input sanitization and insecure DOM manipulation within the Etherpad codebase. Specifically, the function result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute string before assigning the generated markup to node.innerHTML.\nAdditionally, the function ImportEtherpad.setPadRaw located in src/node/utils/ImportEtherpad.ts accepts attacker-controlled attribute-pool values from a crafted .etherpad import. This includes manipulated list:number1 definitions combined with a malicious start value.\nThe attack flow proceeds as follows: First, an attacker constructs a malicious .etherpad file containing payload strings injected into the list start attribute within the attribute pool. Second, the attacker uploads or imports this crafted file into a pad where they possess write access via ImportEtherpad.setPadRaw. Third, the malicious attribute values are stored persistently within the pad data structure. Finally, when any user or administrator opens the stored pad or navigates to the /timeslider endpoint, the vulnerable result.appendSpan function parses the stored attribute and directly interpolates the unquoted start value into the innerHTML assignment. This triggers the execution of the injected script payload in the browser of the victim.\nThe affected component involves DOM rendering and import parsing logic across src/static/js/domline.ts and src/node/utils/ImportEtherpad.ts in Etherpad versions prior to 3.3.1.\nExploitation requires authentication and write access to a pad, allowing the storage of malicious markup that subsequently executes without further interaction when rendered to other users."
}