Etherpad versions before 3.3.1 contain a cross-site scripting vulnerability due to improper neutralization of input in the 'start' attribute of numbered lists. The function result.appendSpan in src/static/js/domline.ts directly interpolates the 'start' attribute into an unquoted ol start attribute, and ImportEtherpad.setPadRaw accepts attacker-controlled attribute-pool values from crafted .etherpad imports. This enables any user with write access to a pad to store malicious markup that executes as XSS when another user opens the pad or the /timeslider view, potentially impacting administrators. The issue is resolved in version 3.3.1.

Successful exploitation allows an attacker with write access to a pad to execute arbitrary script code in the context of other users viewing the pad or timeslider, including administrators. This can lead to complete compromise of confidentiality and integrity of user sessions and data, and partial availability impact. The CVSS 3.1 score is 9.6 (critical), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality and integrity with low impact on availability.

Upgrade Etherpad to version 3.3.1 or later, where this vulnerability is fixed. No other mitigations are indicated or required according to the available data.