Maintainer Mode
Sign in with GitHub

etherpad-lite

etherpad-lite 2.7.2 · pkgs/by-name/et/etherpad-lite/package.nix
Sign in to subscribe
Health
Risk
risk 28 medium
  • +15 marked insecure: meta.knownVulnerabilities
  • +12 2.7.2 is behind upstream 3.3.8, a major release
  • +1 no versionCheckHook
Version
2.7.2 upstream 3.3.8
Channels
master 2.7.2 · nixos-unstable 2.7.2 · nixos-26.05 2.7.2 no channel is behind master
Hydra
succeeded 2d ago
Advisories
none open
Packaging
meta.knownVulnerabilities no versionCheckHook
Packagewhat each field means
Description
Modern really-real-time collaborative document editor
Long description
Etherpad is a real-time collaborative editor scalable to thousands of simultaneous real time users. It provides full data export capabilities, and runs on your server, under your control.
Homepage
https://etherpad.org/
Changelog
https://github.com/ether/etherpad/blob/refs/tags/v2.7.2/CHANGELOG.md
License
Apache-2.0
Platforms
45 platforms: Linux, Darwin
Main program
etherpad-lite
Source provenance
not set: built from source
Outputs
out
Status
insecure
  • CVE-2026-55090: Stored XSS in HTML export via unescaped attribute-pool values
  • GHSA-92hr-gmr6-h8cp: Hardening: weak token RNG, login timing, plugin path handling, API request handling
  • CVE-2026-55089: JWT `admin` claim presence-only check lets non-admin OAuth users invoke every Etherpad HTTP API endpoint
  • CVE-2026-55088: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
  • CVE-2026-55087: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)
  • CVE-2026-55086: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
  • CVE-2026-55085: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite
  • GHSA-6vx2-3gwr-958v: Stored XSS in HTML diff export via unescaped author color values in getHTMLFromAtext
  • GHSA-62cj-9j72-mfrh: OIDC interactive login accepts the literal "undefined"/"null" as the password for accounts that have none
  • GHSA-4mx2-rqx5-2pp6: Forged tag: class token via a space in a start attribute gives stored XSS in appendSpan
  • GHSA-38vj-95q4-gwvx: OIDC: a user whose sub matches a configured client_id is treated as client_credentials and gets admin API access
  • etherpad-lite is currently outdated within nixpkgs. An update is needed: https://github.com/NixOS/nixpkgs/issues/572875
Position
pkgs/by-name/et/etherpad-lite/package.nix:83
Maintainers
erdnaxe, f2k1de
Version bumps 0all open bumps
None open. Upstream has 3.3.8: how to update a package.
Pull requests 1
pnpmConfigHook: strip pnpm install state from outputs
#556271 by ak2k · opened 7w ago
Closed or merged in the synced window 2
[Backport release-26.05] etherpad-lite: mark vulnerable
#574416 by nixpkgs-ci · merged 10h ago
etherpad-lite: mark vulnerable
#572883 by herbetom · merged 1d ago
Issues 1
Update Request: etherpad-lite 2.7.2 → 3.3.8 1.severity: security
#572875 by herbetom · opened 5d ago · 0 comments