The vulnerability (CVE-2026-55090) in Etherpad Lite is due to the function getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolating values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML-attribute escaping. Since the attribute values come directly from the pad attribute pool, which can be controlled by a pad editor through crafted changesets, an attacker can inject malicious attribute values such as " onload="alert(1)". When exported, this results in a span tag like <span data-color="" onload="alert(1)">, leading to stored XSS when the exported HTML is viewed by collaborators. The issue is fixed by escaping attribute names and values using Security.escapeHTMLAttribute, as implemented in PR #7905.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of collaborators viewing the exported HTML, potentially leading to session hijacking, data theft, or other malicious actions. The vulnerability affects all collaborators who open the exported HTML containing the malicious payload.

An official fix is available that properly escapes attribute values in the HTML export functionality. Users should upgrade Etherpad Lite to version 3.3.0 or later. No additional mitigation is required once the patch is applied.