ep_etherpad-lite
npm · Package
Vulnerability alerts
Follow| Report | Product | Ecosystem | Severity | Fix status | Last updated |
|---|---|---|---|---|---|
| Etherpad has stored XSS in HTML export via unescaped attribute-pool values | ep_etherpad-lite | npm | High | Fix reported | |
| Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling | ep_etherpad-lite | npm | Medium | Fix reported | |
| ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token | ep_etherpad-lite | npm | Medium | Fix reported | |
| ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite | ep_etherpad-lite | npm | Medium | Fix reported | |
| ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header | ep_etherpad-lite | npm | Medium | Fix reported | |
| Etherpad Lite Access Restriction Bypass | ep_etherpad-lite | npm | Critical | Fix reported |