npm/ep_etherpad-lite

Etherpad has stored XSS in HTML export via unescaped attribute-pool values

Modified: 8/17/2026

ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite

Modified: 8/13/2026

Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

Modified: 8/17/2026

ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header

Modified: 8/13/2026

Etherpad Lite Access Restriction Bypass

Modified: 11/8/2023

ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token

Modified: 8/13/2026