This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+9 more
Affected surfaces
ReleasePort's take
Moderate signalEtherpad‑Lite v3.3.1 patches a stored XSS vulnerability in the numbered‑list start attribute and adds robust DB connection error handling for PostgreSQL, Redis, and RethinkDB.
Why it matters: Fixes GHSA‑f7h5‑v9hm‑548j (stored XSS) with escapes/integer coercion; prevents process crashes from dropped DB connections via keep‑alive and error handlers. Severity 90 indicates critical risk.
Summary
AI summaryFixes stored‑XSS in numbered-list start attribute and hardens DB layer against dropped PostgreSQL/Redis/RethinkDB connections.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Escapes and integer‑coerces the numbered-list `start` attribute to prevent stored XSS (GHSA-f7h5-v9hm-548j). Escapes and integer‑coerces the numbered-list `start` attribute to prevent stored XSS (GHSA-f7h5-v9hm-548j). Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Dependency | Low |
Updates `semver` to 7.8.3, `rate-limiter-flexible` to 11.2.0, and refreshes dev‑dependencies (issues #7933/#7934/#7932). Updates `semver` to 7.8.3, `rate-limiter-flexible` to 11.2.0, and refreshes dev‑dependencies (issues #7933/#7934/#7932). Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Bugfix | Medium |
Paints root canvas for iOS dark mode, removing white status‑bar strip (issue #7606/#7931). Paints root canvas for iOS dark mode, removing white status‑bar strip (issue #7606/#7931). Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Bugfix | Medium |
Shows detected language in settings dropdown (issue #7925/#7928). Shows detected language in settings dropdown (issue #7925/#7928). Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Bugfix | Medium |
Suppresses deletion token and modal when `allowPadDeletionByAllUsers` is enabled (issue #7929). Suppresses deletion token and modal when `allowPadDeletionByAllUsers` is enabled (issue #7929). Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Bugfix | Medium |
Prevents one unreadable pad from blanking the Admin Manage‑pads list (issue #7935/#7938). Prevents one unreadable pad from blanking the Admin Manage‑pads list (issue #7935/#7938). Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Bugfix | Medium |
Handles PostgreSQL pool errors and enables TCP keep‑alive; adds Redis and RethinkDB connection‑error handlers to avoid process crash (ueberdb2 6.1.9). Handles PostgreSQL pool errors and enables TCP keep‑alive; adds Redis and RethinkDB connection‑error handlers to avoid process crash (ueberdb2 6.1.9). Source: llm_adapter@2026-06-10 Confidence: low |
— |
Full changelog
3.3.1
3.3.1 is a small bug-fix and hardening follow-up to 3.3.0. It closes a stored-XSS vector in the numbered-list start attribute, hardens the database layer so a dropped connection to PostgreSQL / Redis / RethinkDB no longer crashes the process (via ueberdb2 6.1.9), and fixes a handful of pad and admin regressions — the iOS dark-mode status bar, the settings language dropdown, the pad-deletion modal under allowPadDeletionByAllUsers, and a single unreadable pad blanking the admin Manage-pads list.
Security
- Pad editor — escape and integer-coerce the numbered-list
startattribute (GHSA-f7h5-v9hm-548j, #7937). A crafted<ol start>value flowed unescaped intodomline.ts, a distinct client-side sink from the export-path fix in 3.3.0's #7905. The value is now integer-coerced and HTML-escaped before it reaches the DOM. A jsdom regression test covers the sink.
Notable fixes
- Skin — paint the root canvas so iOS dark mode has no white status bar (#7606 / #7931). iOS Safari paints the top safe area from the
htmlroot background, whichtheme-color(an Android address-bar hint) does not affect, so dark-mode pads showed a white status-bar strip on iOS. Colibris now sets the root background andcolor-schemeso the safe area matches the editor. - Settings — show the detected language in the dropdown (#7925 / #7928). The settings language
<select>did not reflect the language Etherpad had actually auto-detected; it now shows the active selection. - Pad — don't issue a deletion token (or show its modal) when
allowPadDeletionByAllUsersis on (#7929). With pad deletion open to all users the client still minted a deletion token and surfaced the confirm modal; both are now suppressed in that configuration. - Admin — one unreadable pad no longer empties the Manage-pads list (#7935 / #7938). A single pad that failed to read could throw out of the list-hydration path and blank the entire admin Manage-pads view; the read is now guarded per-pad so the rest of the list still renders.
Internal / contributor-facing
- CI — downstream client compatibility gate (#7923 / #7924 / #7927). A new gate smoke-tests the published
etherpad-pad,etherpad-cli, andetherpad-desktopclients against the server build (Phase 1 + Phase 2), with robust per-client error handling inrun-clients.shso one client's failure is reported rather than masking the others. - CI — verify Etherpad boots offline (#7936). Adds a test step that confirms a built Etherpad starts with no network access.
Dependencies
ueberdb26.1.8 → 6.1.9 — PostgreSQL pool errors are now handled and TCP keep-alive is enabled (fixes #7878), and the Redis and RethinkDB drivers attach connection-error handlers so a dropped database connection no longer crashes the Etherpad process.semver7.8.2 → 7.8.3 (#7933),rate-limiter-flexible11.1.1 → 11.2.0 (#7934), plus a dev-dependencies group update (#7932).
Security Fixes
- GHSA-f7h5-v9hm-548j — escape and integer‑coerce numbered-list `start` attribute to close stored XSS
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About etherpad-lite
Etherpad: A modern really-real-time collaborative document editor.
Related context
Beta — feedback welcome: [email protected]