ep_etherpad-lite vulnerabilities (npm)

6 vulnerabilities.

• ep_etherpad-lite npm Etherpad: Stored XSS in HTML export via unescaped attribute-pool values CVE-2026-55090 Fix available 5.3 MediumAugust 17, 2026
• ep_etherpad-lite npm Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling GHSA-92hr-gmr6-h8cp Fix available No scoreAugust 17, 2026
• ep_etherpad-lite npm Etherpad: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token CVE-2026-55088 Fix available 6.8 MediumAugust 13, 2026
• ep_etherpad-lite npm Etherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite CVE-2026-55086 Fix available 4.2 MediumAugust 13, 2026
• ep_etherpad-lite npm Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect) CVE-2026-55087 Fix available 6.1 MediumAugust 13, 2026
• ep_etherpad-lite npm Etherpad Lite Access Restriction Bypass CVE-2018-6835 Fix available 9.8 CriticalFebruary 8, 2018