CVE-2026-55090 ether CVE debrief

Who should care

Defenders responsible for Etherpad deployments should assess exposure and apply the patch. Review of user-supplied content and monitoring for suspicious activity are also recommended.

Why it matters

CVE-2026-55090 is a medium-severity vulnerability in Etherpad that allows for cross-site scripting (XSS) attacks via HTML exports due to inadequate HTML attribute escaping. Defenders should prioritize verifying exposure and applying the patch.

• XSS attacks through HTML exports require verification from official sources.
• Defenders must verify exposure and apply the patch to prevent potential attacks.
• Monitoring for suspicious activity related to HTML exports and user-supplied content is necessary.

Technical summary

The getHTMLFromAtext function in Etherpad's ExportHtml.ts file interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without proper HTML attribute escaping. This allows an attacker to inject malicious values, potentially leading to cross-site scripting (XSS) attacks when the resulting HTML export is opened. The vulnerability is fixed in Etherpad version 3.3.0. An attacker can exploit this by manipulating the exportHtmlAdditionalTagsWithData plugin hook to inject malicious values into span data attributes. Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for XSS attacks through HTML exports.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows for XSS attacks through HTML exports.

Recommended defensive actions

• Verify if the deployed Etherpad version is prior to 3.3.0 and apply the patch if necessary.
• Review and restrict usage of the exportHtmlAdditionalTagsWithData plugin hook to prevent malicious input.
• Monitor for suspicious activity related to HTML exports and user-supplied content.
• Perform a thorough review of user-supplied content for potential malicious activity.
• Inventory and track Etherpad deployments to ensure all instances are updated.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Review and update incident response plans to include procedures for handling potential XSS attacks.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, additional information on potential exploitation or affected deployments is limited. Defenders should verify exposure and apply the patch. The vulnerability allows for cross-site scripting (XSS) attacks through HTML exports due to inadequate HTML attribute escaping in the getHTMLFromAtext function. Limited information is available on potential exploitation or affected deployments. Official sources indicate the issue is fixed,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.