Advisories for Npm/Ep_etherpad-Lite package

Fix: PR #7905 (ether/etherpad). getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data-<k>="<v>" without HTML-attribute escaping. The value comes verbatim from the pad attribute pool, which a pad editor controls via a crafted changeset (only author attributes are validated; moveOpsToNewPool -> AttributePool.putAttrib stores any value). With a bundled plugin that registers the hook (ep_font_color / ep_font_size), an attribute value such as " onload="alert(1) is exported as …

Fix: PR #7906 (ether/etherpad). A set of medium/low hardening fixes: Weak RNG for tokens (CWE-330): author/session/readonly IDs were generated with Math.random() (client and server). Now use crypto.getRandomValues. Login timing / no failure delay (CWE-208/CWE-307): the OIDC interaction login used a non-constant-time password compare with no failure delay. Now uses crypto.timingSafeEqual plus a uniform failure delay; user lookup is own-property only. Plugin dependency path handling (CWE-22): plugin dependency names from package.json …

src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts both compute their temporary working-file paths as: const randNum = Math.floor(Math.random() * 0xFFFFFFFF); const srcFile = ${os.tmpdir()}/etherpad_export_${randNum}.html; const destFile = ${os.tmpdir()}/etherpad_export_${randNum}.${type}; Two flaws compound: Math.random() is not crypto-secure. It yields at most ~32 bits of entropy and is predictable across calls within the same Node process (V8 shares PRNG state between consecutive Math.random() invocations). An attacker on the same host who observes any earlier temp-file name from …

Etherpad's device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token in the GET response body

Etherpad lets operators run behind a reverse proxy that prefixes every route with a subpath (e.g. /pad/etherpad/…). The proxy is expected to set x-proxy-path: /pad/etherpad on every request so that server-rendered links, asset URLs, and redirects know to include the prefix. Two server-side call sites historically processed this header:

node/hooks/express/apicalls.js in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.