Description
Fix: PR #7906 (ether/etherpad). A set of medium/low hardening fixes:
- Weak RNG for tokens (CWE-330): author/session/readonly IDs were generated with
Math.random()(client and server). Now usecrypto.getRandomValues.
Recommendation
Update the ep_etherpad-lite package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.8.14
- Patched version(s): 3.3.0
References
Could your website be exposed too?
SmartScanner can check your website for Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling and gives you actionable findings to investigate.
Start a free scanRelated Issues
- obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/wr - Vulnerability
- ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header - CVE-2026-55087
- docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token - CVE-2025-53624
- TinyMCE mXSS vulnerability in undo/redo, getContent API, resetContent API, and Autosave plugin - CVE-2023-45818
You might also like:
See something that needs correcting? Let us knowUpdated August 17, 2026