ep_etherpad-lite npm Package Vulnerability: What We Know
- Severity
- HIGH
- Affected component
- ep_etherpad-lite (npm)
- Affected versions
- < 3.1.0 or >= 2.1.0, < 3.1.0 or < 1.6.3 or >= 2.6.0, < 3.1.0
- Patched version
- Not yet available
An early warning has been issued for a vulnerability in the ep_etherpad-lite npm package. Users of affected versions should assess their exposure and take recommended actions.
What happened
The ep_etherpad-lite npm package reportedly uses Math.random() for generating temporary file paths, which is predictable and can lead to symlink-based file overwrite attacks. This affects deployments running Etherpad with local access. The vulnerability is under investigation and no exploits in the wild have been confirmed.
The affected versions are < 3.1.0 or >= 2.1.0, < 3.1.0 or < 1.6.3 or >= 2.6.0, < 3.1.0. Users of these versions should evaluate their risk based on their deployment environment and the potential for local attackers to access the file system.
What to do about it
- Avoid using ep_etherpad-lite in environments where local attackers can access the file system.
- Consider alternative methods for generating unique file paths.
- Monitor the primary sources for updates on a potential fix.
- Consult the primary sources for the most current information on affected versions and recommended actions.
How 0Day would have caught this
ep_etherpad-lite is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using ep_etherpad-lite npm package versions < 3.1.0 or >= 2.1.0, < 3.1.0 or < 1.6.3 or >= 2.6.0, < 3.1.0.
What should I do right now?
Avoid using ep_etherpad-lite in environments where local attackers can access the file system. Consider alternative methods for generating unique file paths. Monitor the primary sources for updates on a potential fix.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.
How can I assess my exposure?
Evaluate your risk based on your deployment environment and the potential for local attackers to access the file system.