{"action":"Upgrade ep_etherpad-lite to 3.1.0 or later.","affected":[{"fixed":"3.1.0","introduced":"2.1.0"}],"component":"ep_etherpad-lite","cve_ids":["CVE-2026-55087"],"ecosystem":"npm","epss":0.00578,"exploited":false,"fixed_versions":["3.1.0"],"ghsa_id":"GHSA-fjgc-3mj7-8rg8","id":"tcs_01M5KFNPS1SYRK7NDXFC2NMVPC","modified_at":"2026-08-13T14:10:58.719555Z","published_at":"2026-08-13T13:46:07Z","references":["https://osv.dev/vulnerability/GHSA-fjgc-3mj7-8rg8","https://github.com/ether/etherpad/security/advisories/GHSA-fjgc-3mj7-8rg8","https://github.com/ether/etherpad/pull/6399","https://github.com/ether/etherpad/pull/7710","https://github.com/ether/etherpad/pull/7784","https://github.com/ether/etherpad/commit/451bd9c3ebb0dded99dd0ff21811ee00e0940c29","https://github.com/ether/etherpad/commit/63e9b2d4eb303cd341022591bdf9484584db36e3","https://github.com/ether/etherpad"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-fjgc-3mj7-8rg8","url":"https://osv.dev/vulnerability/GHSA-fjgc-3mj7-8rg8"}],"summary":"ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header"}