Insufficient Entropy in PRNG Affecting ep_etherpad-lite package, versions *
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-EPETHERPADLITE-18861254
- published17 Aug 2026
- disclosed13 Aug 2026
- creditUnknown
Introduced: 13 Aug 2026
CVE-2026-55086 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
ep_etherpad-lite is a modern really-real-time collaborative document editor.
Affected versions of this package are vulnerable to Insufficient Entropy in PRNG through the ImportHandler and ExportHandler in src/node/handler/ImportHandler.ts and src/node/handler/ExportHandler.ts. An attacker can overwrite files the Etherpad process can write by predicting a temp filename and planting a symlink in the shared /tmp directory before an import or export runs. The handlers derive temp-file path tokens from Math.random(), making the filenames guessable on a multi-tenant host. When the process writes or renames the temporary export/import file, it follows the attacker’s symlink and clobbers the linked target, which can corrupt data or overwrite sensitive files accessible to the Etherpad account.