This is a critical stored XSS vulnerability (CVSS 9.6) affecting Etherpad through version 3.3.0. The attack vector is the start attribute on ordered lists, which becomes exploitable when content is imported via .etherpad files.
The root cause lies in Etherpad's attribute pool architecture. This system manages collaborative document state, storing HTML attribute values as neutral data without tracking their sanitization provenance. When ImportEtherpad.setPadRaw accepts arbitrary values from crafted .etherpad files and populates this pool, those values carry whatever trust level the import function assigns—which turns out to be inappropriate for the HTML rendering path in domline.ts. List rendering code assumed start attribute values would only come from controlled parser paths, not from user-importable structured data.
This represents a systemic trust boundary failure: the system drew trust perimeters around features rather than data flows. The attribute pool functioned as a "trust escrow" that was never properly audited. The start attribute itself had become invisible to security review precisely because it was semantically deprecated in HTML5 (replaced by CSS counters), making it an easy oversight.
Attackers exploiting this can inject malicious JavaScript through crafted .etherpad files containing <ol start="..."> payloads. When any reader—including administrators accessing /timeslider—views the pad, the rendering path uncritically uses the attribute pool's values, triggering script execution. The collaborative editing model itself becomes the weapon: any writer can target all subsequent readers without compromising the server or stealing credentials.
The 3.3.1 fix likely restructured how the attribute pool feeds into rendering, implementing provenance tracking rather than just patching an escape call. This distinction matters—it indicates whether the vulnerability was architectural. Deprecated or semantically-inert HTML attributes throughout the codebase should be audited. If start was the reported vector, similar patterns likely exist elsewhere in list-related attributes or in other elements that aren't actively maintained.