Description
Fix: PR #7905 (ether/etherpad).
getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data-<k>="<v>" without HTML-attribute escaping.
Recommendation
Update the ep_etherpad-lite package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.8.14
- Patched version(s): 3.3.0
References
Could your website be exposed too?
SmartScanner can check your website for Etherpad has stored XSS in HTML export via unescaped attribute-pool values and gives you actionable findings to investigate.
Start a free scanRelated Issues
- PostCSS has XSS via Unescaped </style> in its CSS Stringify Output - CVE-2026-41305
- SCEditor has DOM XSS via emoticon URL/HTML injection - CVE-2026-25581
- Apostrophe has default XSS via `xmp` raw-text passthrough in `sanitize-html` - CVE-2026-44990
- Open WebUI has Stored XSS in Banner Component via Improper Sanitization Order - CVE-2026-45665
You might also like:
See something that needs correcting? Let us knowUpdated August 17, 2026