Etherpad is a real-time collaborative editor. In versions before 3.3.1, the function result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute, which is then assigned to node.innerHTML without proper sanitization. Additionally, ImportEtherpad.setPadRaw in src/node/utils/ImportEtherpad.ts accepts attacker-controlled attribute-pool values from crafted .etherpad imports, including malicious start values for list:number1. This combination allows an attacker with write access to store markup that executes as cross-site scripting (CWE-79) when another user opens the pad or the timeslider view. The issue is resolved in Etherpad version 3.3.1.

Successful exploitation allows an attacker with write access to a pad to execute arbitrary script code in the context of other users viewing the pad or timeslider, including administrators. This can lead to compromise of user sessions, theft of credentials, or other malicious actions within the Etherpad application context. The CVSS score of 9.6 reflects a critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and low impact on availability.

This vulnerability is fixed in Etherpad version 3.3.1. Users and administrators should upgrade to version 3.3.1 or later to remediate this issue. No official patch links are provided in the data, but upgrading to the fixed version is the recommended action. Since this is not a cloud service, remediation depends on user action to update their installations.