Etherpad Stored XSS Vulnerability: Early Warning and Mitigation Steps
- Severity
- HIGH
- Affected component
- etherpad (npm)
- Patched version
- Not yet available
Etherpad has reportedly a stored XSS vulnerability in its HTML export feature. This vulnerability allows for HTML-attribute escaping bypass, leading to stored XSS for any collaborator who opens the export.
What happened
Etherpad is under investigation for a stored XSS vulnerability in its HTML export functionality. The issue arises from unescaped attribute-pool values, which can be exploited to bypass HTML-attribute escaping. This vulnerability could allow an attacker to inject malicious scripts that are stored and executed when a collaborator opens the export. The vulnerability was first flagged on 2026-08-17T17:49:38+00:00 and is tracked under GHSA-2JP7-WWPG-3P9W.
The vulnerability has not been exploited in the wild as of the latest reports. However, it is critical for users to assess their exposure and take immediate action to mitigate potential risks. The recommended action is to upgrade to the latest version of Etherpad that includes the fix in PR #7905.
What to do about it
- Check if your Etherpad installation is up to date.
- Upgrade to the latest version of Etherpad that includes the fix in PR #7905.
- Monitor the primary sources for updates on the vulnerability and any official fixes.
- Review your Etherpad configuration and ensure that all collaborators are aware of the potential risk.
- Consider implementing additional security measures to protect against XSS attacks until the vulnerability is fully mitigated.
How 0Day would have caught this
etherpad is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using Etherpad, you should assess your exposure to this vulnerability. The specific version range affected has not been published yet.
What should I do right now?
Upgrade to the latest version of Etherpad that includes the fix in PR #7905. Monitor the primary sources for updates on the vulnerability and any official fixes.
Has this been exploited in the wild?
No, the vulnerability has not been exploited in the wild as of the latest reports.
Where can I find more information about this vulnerability?
Consult the primary source at https://github.com/ether/etherpad/security/advisories/GHSA-2jp7-wwpg-3p9w for the latest information.