CVE-2026-55085 ether CVE debrief

Who should care

Administrators and users of Etherpad instances, especially those with write access to pads, should be aware of this critical vulnerability and take steps to mitigate it. They should prioritize updating to version 3.3.1 and restrict write access to pads to trusted users. Additionally, they should monitor for suspicious activity on Etherpad instances and review compensating controls for exposed systems while remediation is scheduled and verified. This includes checking relevant monitoring, detection, and logs for exposed assets that need extra review. Affected operators, platforms, and security teams should also review the official advisory to validate affected scope, severity, and vendor guidance. They should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and track exceptions, retest remediated assets, and close the item only after evidence is documented. Asset inventory and rollback/change windows should also be considered in the remediation process. Source tracking and exposure review are crucial in ensuring that all affected systems are identified and remediated. Monitoring and compensating controls can help mitigate the risk while remediation is in progress. The vulnerability's impact on the operator, platform, and security team requires immediate attention to prevent potential attacks. By taking these steps, administrators and users can minimize the risk associated with this critical vulnerability and ensure the security of their Etherpad instances. They should also confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. This will help in prioritizing and coordinating the remediation efforts effectively. Overall, a comprehensive approach that includes updating, restricting access, monitoring, and reviewing compensating controls is essential to mitigate this critical vulnerability effectively. The affected product or component is Etherpad, and the vulnerability class is cross-site scripting (XSS). The likely operational impact is high, given the critical severity of the vulnerability. The source-confidence limits are high, as the vulnerability is well

Technical summary

Etherpad versions prior to 3.3.1 are vulnerable to cross-site scripting (XSS) attacks. The vulnerability exists in the result.appendSpan function in src/static/js/domline.ts, which interpolates the start attribute of a numbered list directly into an unquoted ol start attribute. An attacker with write access to a pad can store malicious markup that executes as XSS when another user opens the pad or /timeslider. This issue is fixed in version 3.3.1.

Defensive priority

Administrators and users of Etherpad should prioritize updating to version 3.3.1 to mitigate this critical vulnerability.

Recommended defensive actions

• Update Etherpad to version 3.3.1 or later
• Restrict write access to pads to trusted users
• Monitor for suspicious activity on Etherpad instances
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD detail provide evidence of a critical vulnerability in Etherpad versions prior to 3.3.1. The vulnerability allows for cross-site scripting (XSS) attacks when a user with write access to a pad stores malicious markup. To verify, defenders should review the official advisory, assess their exposure, and monitor for suspicious activity. The vulnerability exists in the result.appendSpan function in src/static/js/domline.ts, which interpolates the start attribute of a numbered list directly into an unquoted ol start attribute.

Official resources