Skip to content
OpenAdvisories

Package · npm

ep_etherpad-lite

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 4.2
    CVE-2026-55086

    Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

    Etherpad is a real-time collaborative editor. Prior to 3.1.0, src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts derive temporary filenames from Math.random() and place them in os.tmpdir(). On a host with a shared world-writable temporary…

    ether etherpad ep_etherpad-lite npm
  • Medium 5.3
    CVE-2026-55090

    Etherpad: Stored XSS in HTML export via unescaped attribute-pool values

    Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor ca…

    ether etherpad ep_etherpad-lite npm
  • Medium 6.8
    CVE-2026-55088

    Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

    Etherpad is a real-time collaborative editor. From 2.6.0 until 3.1.0, Etherpad's src/node/hooks/express/tokenTransfer.ts uses POST /tokenTransfer to store an author token for transfer between browsers and exposes it through GET /tokenTransfer/{uuid}. Although…

    ether etherpad ep_etherpad-lite npm
  • Medium 6.1
    CVE-2026-55087 Scanner template

    Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)

    Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization…

    ether etherpad ep_etherpad-lite npm
  • Medium —
    GHSA-92hr-gmr6-h8cp

    Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

    Fix: PR #7906 (ether/etherpad). A set of medium/low hardening fixes: - **Weak RNG for tokens (CWE-330):** author/session/readonly IDs were generated with `Math.random()` (client and server). Now use `crypto.getRandomValues`. - **Login timing / no failure dela…

    ep_etherpad-lite npm
  • Critical 9.8
    CVE-2018-6835

    Etherpad Lite Access Restriction Bypass

    node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.

    ep_etherpad-lite npm