{"apiVersion":"1.0","identifier":"CVE-2026-55085","description":"Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in src/node/utils/ImportEtherpad.ts accepts attacker-controlled attribute-pool values from a crafted .etherpad import, including list:number1 and a malicious start value. Any user with write access to a pad can store markup that executes as cross-site scripting when another user opens the pad or /timeslider, including when an administrator views the pad. This issue is fixed in version 3.3.1.","publishedAt":"2026-08-19T20:17:17","lastModifiedAt":"2026-08-21T20:16:37","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55085","cvssScore":9.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L","epssProbability":0.00362,"riskScore":0.99,"affectedProduct":"Etherpad","affectedVersions":"<3.3.1","vulnerabilityType":"Web app","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-55085","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-55085","en":"https://www.redsauce.net/en/cves/CVE-2026-55085","fr":"https://www.redsauce.net/fr/cves/CVE-2026-55085","pt":"https://www.redsauce.net/pt/cves/CVE-2026-55085","de":"https://www.redsauce.net/de/cves/CVE-2026-55085","sk":"https://www.redsauce.net/sk/cves/CVE-2026-55085","el":"https://www.redsauce.net/el/cves/CVE-2026-55085"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-55085"}}