Skip to main content
cve.nowby Sazabi
← npm
npmPackage

ep_etherpad-lite

5 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 4 medium
Weekly downloads
586
Dependents
3
Registry
npm

Advisories 5

  • CVE-2026-55086Medium 4.2

    Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

    Affected: fixed in 3.1.0.

  • CVE-2026-55090Medium 5.3

    Etherpad: Stored XSS in HTML export via unescaped attribute-pool values

    Affected: fixed in 3.3.0.

  • CVE-2026-55088Medium 6.8

    Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

    Affected: from 2.6.0, fixed in 3.1.0.

  • CVE-2026-55087Medium 6.1

    Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)

    Affected: from 2.1.0, fixed in 3.1.0.

  • node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access…

    Affected: fixed in 1.6.3.