Cross-site scripting in Etherpad - #VU154090
Published: October 12, 2026
Vulnerability identifier: #VU154090
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in a victim's browser.
The vulnerability exists due to improper neutralization of attribute values in linestylefilter.ts and domline.appendSpan when rendering stored span attributes. A remote user can submit a crafted changeset containing a space and a forged tag token in a start attribute value to execute arbitrary JavaScript in a victim's browser.
The payload requires the absence of a list attribute to bypass the lineAttribMarker branch. User interaction is required to view the malicious content, including through the timeslider renderer.
Affected software
Etherpad
Remediation
Install security update from vendor's website.
Etherpad - update to 3.3.7