Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Fix: PR #7905 (ether/etherpad). getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data-<k="<v" without HTML-attribute escaping. The value comes verbatim from the pad attribute pool, which a pad editor controls via a crafted changeset (only author attributes are validated; moveOpsToNewPool - AttributePool.putAttrib stores any value). With a bundled plugin that registers the hook (epfontcolor / epfontsize), an attribute value such as " onload="alert(1) is exported as <span data-color="" onload="alert(1)" and served as text/html, yielding stored XSS for any collaborator who opens the export. Fix: escape the name and value via Security.escapeHTMLAttribute. PR #7905 also adds a startup warning when default/placeholder account or SSO credentials are configured (defense-in-depth, non-breaking).
Recommended action: Upgrade to 3.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Fix: PR #7906 (ether/etherpad). A set of medium/low hardening fixes: - Weak RNG for tokens (CWE-330): author/session/readonly IDs were generated with Math.random() (client and server). Now use crypto.getRandomValues. - Login timing / no failure delay (CWE-208/CWE-307): the OIDC interaction login used a non-constant-time password compare with no failure delay. Now uses crypto.timingSafeEqual plus a uniform failure delay; user lookup is own-property only. - Plugin dependency path handling (CWE-22): plugin dependency names from package.json were used to build filesystem paths without validation (admin-gated install). Now validated against the npm name grammar. - API parameter pollution (CWE-235): /api/2 merged all request headers into the API field set. Now forwards only authorization, matching the openapi.ts handler. - Pad-creation side effect: API.appendChatMessage could create arbitrary pads (missing getPadSafe). Now requires the pad to exist. - Error info disclosure (CWE-209): the…
Recommended action: Upgrade to 3.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Etherpad's device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token in the GET response body Description Etherpad ships an endpoint pair under /tokenTransfer (src/node/hooks/express/tokenTransfer.ts) that lets a logged-in user move their HttpOnly author token to a different browser (typically by scanning a QR code containing the transfer URL). The flow is: 1. POST /tokenTransfer — the source device sends a request whose own author cookie is read off the server-side cookie jar. The server mints a random UUID and stores the author token (and arbitrary prefsHttp field) under a DB key keyed by that UUID. The UUID is returned. 2. GET /tokenTransfer/{uuid} — the destination device GETs the URL containing the UUID. The server reads the stored record and sets the HttpOnly author cookie on the response. The original implementation has three serious flaws: 1. No expiration check. createdAt is written to the record on POST but never…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts both compute their temporary working-file paths as: Two flaws compound: 1. Math.random() is not crypto-secure. It yields at most ~32 bits of entropy and is predictable across calls within the same Node process (V8 shares PRNG state between consecutive Math.random() invocations). An attacker on the same host who observes any earlier temp-file name from logs or other side channels can predict subsequent names. 2. The paths land in os.tmpdir(). On a typical Linux system this is /tmp — a shared world-writable directory. An unprivileged local attacker can pre-create a symbolic link at a predicted path pointing at any file the Etherpad process can write: When ExportHandler calls fs.writeFile(srcFile, html) (or ImportHandler calls fs.rename(srcFile, destFile) / soffice writes its converted output to the path), the open syscall follows the symlink and either reads from or overwrites the linked target. For…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
GHSA-03 — x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect) Severity: Medium CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS suggested base score: ~6.1 — Medium (Re-validate in the first.gov calculator before filing. Score depends heavily on whether you assume a cooperative cache exists in front of the deployment — single-origin admin-only ops with no shared cache push toward 4.x; cache-poisoning against a CDN pushes toward 7.x.) CWE: CWE-79 Improper Neutralization of Input During Web Page Generation, CWE-601 URL Redirection to Untrusted Site, CWE-444 Inconsistent Interpretation of HTTP Requests Title x-proxy-path request header is interpolated into admin HTML/JS/CSS without sanitisation (cache-poisoning XSS) and into a /p/:pad/timeslider redirect target (open-redirect via protocol-relative URL) Description Etherpad lets operators run behind a reverse proxy that prefixes every route with a…
Recommended action: Upgrade to 3.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.
Recommended action: Upgrade to 1.6.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.