The vulnerability allows cross‑site scripting via an unquoted <ol> start attribute that is inserted directly into the page markup. The flaw originates in result.appendSpan within src/static/js/domline.ts and can be triggered by malicious list attributes supplied in a crafted .etherpad import file. Any user with write access to a pad can store markup containing a malicious "start" value, and the script will execute when another user opens that pad or browses the /timeslider, even if the viewer is an administrator.

Etherpad instances running any version earlier than 3.3.1 are affected. The fix is included in release 3.3.1; all installations should verify their version and upgrade if necessary.

The CVSS score of 9.6 reflects critical severity, and the EPSS score is not available but the issue remains uncatalogued in KEV. Based on the description it is inferred that the attack requires an authenticated user with write access to a pad; the exploit allows arbitrary script execution in the context of other users’ browsers, which could compromise confidentiality, integrity, and potentially lead to account takeover. This constitutes a high‑risk vulnerability for any unprotected Etherpad instance.