CVE-2026-55085

COMPONENT VERSION RANGE

NewScan fingerprints Etherpad from its response and reports this CVE when the detected version falls inside the affected range below.

9.6 in NVD, recorded `high` under docs/severity-standard.md: it is stored XSS in a collaborative editor - serious, but it runs in the victim's browser and is not the server-side takeover `critical` is reserved for. result.appendSpan in src/static/js/domline.ts interpolates a numbered list's `start` attribute into an UNQUOTED HTML attribute, so any co-editor of a pad (or anyone at all on the common open-pad install) can break out. Advisory GHSA-f7h5-v9hm-548j says `prior to 3.3.1`. The lower bound `ge 2.0.0` is OURS, not the advisory's: domline.ts is TypeScript and dates from the 2.x rewrite, so a 1.8.x install would be judged by a file it does not have - under-reporting beats a wrong claim (the Bouncy Castle LTS precedent).