{"action":"Upgrade ep_etherpad-lite to 3.3.0 or later.","affected":[{"fixed":"3.3.0","introduced":"0"}],"component":"ep_etherpad-lite","cve_ids":["CVE-2026-55090"],"ecosystem":"npm","epss":0.00547,"exploited":false,"fixed_versions":["3.3.0"],"ghsa_id":"GHSA-2jp7-wwpg-3p9w","id":"tcs_01M5KETDSNQY32ZZ7J2YYZ15DH","modified_at":"2026-08-17T18:11:04.673320Z","published_at":"2026-08-17T17:49:38Z","references":["https://osv.dev/vulnerability/GHSA-2jp7-wwpg-3p9w","https://github.com/ether/etherpad/security/advisories/GHSA-2jp7-wwpg-3p9w","https://github.com/ether/etherpad/pull/7905","https://github.com/ether/etherpad/commit/86c56cf827dd6e5ff1b6cd3760f87adc47f58bb1","https://github.com/ether/etherpad","https://github.com/ether/etherpad/releases/tag/3.3.0"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-2jp7-wwpg-3p9w","url":"https://osv.dev/vulnerability/GHSA-2jp7-wwpg-3p9w"},{"source":"nvd","source_id":"CVE-2026-55090","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55090"}],"summary":"Etherpad has stored XSS in HTML export via unescaped attribute-pool values"}