EUVD-2025-210874
GHSA-9248-q3fg-hqmh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low-privilege upload account required (PR:L); victim must view content (UI:R); scope changes to victim browsers (S:C); session/data exposure but not full system compromise (C:L/I:L).
Primary rating from Vendor (SCHUTZWERK).
CVSS VectorVendor: SCHUTZWERK
Lifecycle Timeline
2DescriptionCVE.org
A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.
AnalysisAI
Stored cross-site scripting in Lumi Education UG's h5p-nodejs-library (all versions prior to 10.0.4) allows an authenticated user with H5P content upload access to embed malicious JavaScript inside an H5P package, which then executes in the browsers of any subsequent users who view that content. The CVSS 4.0 vector (SC:H/SI:H) reflects that the primary damage lands on victim browsers - enabling session hijacking, credential theft, or arbitrary DOM manipulation - rather than on the server itself. No public exploit identified at time of analysis, though the CVSS 4.0 E:P supplemental metric indicates exploit code or proof-of-concept exists.
Technical ContextAI
H5P is an open standard for authoring interactive HTML5 learning content, widely embedded in LMS platforms such as Moodle, Canvas, and WordPress. The h5p-nodejs-library (CPE: cpe:2.3:a:lumi_education_ug:h5p-nodejs-library) is the Node.js server-side runtime that ingests, stores, and serves H5P packages. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) identifies the root cause: user-supplied content within uploaded H5P archives was not adequately sanitized before being rendered to other users. The v10.0.4 release notes explicitly call out that SVG files were blocked as unsafe content and a new SVG sanitizer was introduced, strongly suggesting SVG-embedded script was one of the primary exploitation vectors. The CVSS 4.0 structure correctly models this as a scope-changed vulnerability: VC/VI/VA are all N (server unaffected), while SC:H/SI:H capture the high confidentiality and integrity impact against subsequent systems (victim browsers).
RemediationAI
Upgrade h5p-nodejs-library to version 10.0.4 or later; the vendor-released patch is at https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4. Operators must be aware that v10.0.4 is a breaking release: it requires Node.js 20+, packages are now compiled to ES2022, H5P Core and Editor files must be re-downloaded using the updated install script, the mongodb dependency was updated from v4 to v6 (requiring a library-collection data migration via provided migration methods), aws-sdk moved from v2 to v3 (requiring initialization changes), and h5p-redis-lock switched from ioredis to redis. SVG files are now blocked as content by default unless processed through the new SVG sanitizer - this directly addresses the primary XSS vector. As a compensating control prior to patching, restrict H5P content upload permissions to trusted administrator accounts only and disable end-user upload functionality where not operationally required; this raises the effective privilege bar from PR:L toward PR:H, substantially limiting the attacker pool.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today