What is CVE-2026-55085?
CVE-2026-55085 is a DOM-based XSS vulnerability in the Etherpad real-time collaborative editor. Before version 3.3.1, the `result.appendSpan` function in `domline.ts` improperly interpolates the `start` attribute of numbered lists directly into unquoted HTML assigned to `node.innerHTML`, allowing injection via `ImportEtherpad.setPadRaw`. Users must urgently upgrade to Etherpad 3.3.1 to mitigate this.
Azərbaycanca: CVE-2026-55085 Etherpad real-time əməkdaşlıq redaktorunda ciddi bir DOM-based XSS zəifliyidir. 3.3.1 versiyasından əvvəl `result.appendSpan` funksiyası nömrələnmiş siyahıların `start` atributunu birbaşa `node.innerHTML`-ə daxil edərək təhlükəsizlik boşluğu yaradır. Bu, hücumçuya `ImportEtherpad.setPadRaw` vasitəsilə zərərli JavaScript kodunu icra etməyə imkan verir. Təcili olaraq Etherpad-i 3.3.1 versiyasına yeniləyin.
Related CVEs
link basis: same weakness class CWE-79
FAQ2
Which versions of Etherpad are affected by CVE-2026-55085?
This DOM-based XSS vulnerability affects all versions of Etherpad before 3.3.1.
How can an attacker exploit CVE-2026-55085 to execute malicious code?
An attacker can perform a DOM-based XSS attack by injecting malicious JavaScript code into the `start` attribute of numbered lists via the `ImportEtherpad.setPadRaw` function.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.