PT-2025-20649 · Unknown · Lumi H5P-Nodejs-Library

Published 2025-05-11 · Updated 2025-05-11 · CVE-2025-47828

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Lumi H5P-Nodejs-library versions prior to 9.3.3

Description The issue is related to the omission of a sanitizeHtml call for plain text strings. This could potentially lead to security issues, although specific details about the estimated number of affected devices or real-world incidents are not provided.

Recommendations For versions prior to 9.3.3, update to version 9.3.3 or later to resolve the issue. As a temporary workaround, consider implementing additional sanitization for plain text strings to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-47828

GHSA-M7GM-V253-56HH

Affected Products

Lumi H5P-Nodejs-Library

References · 10

• https://osv.dev/vulnerability/GHSA-m7gm-v253-56hh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47828 · Security Note
• https://osv.dev/vulnerability/CVE-2025-47828 · Vendor Advisory
• https://github.com/Lumieducation/H5P-Nodejs-library/compare/v9.3.2...v9.3.3 · Note
• https://github.com/Lumieducation/H5P-Nodejs-library/pull/3894 · Note
• https://github.com/Lumieducation/H5P-Nodejs-library · Note
• https://t.me/cvenotify/121660 · Telegram Post
• https://t.me/cvedetector/25036 · Telegram Post
• https://t.me/cvetracker/23567 · Telegram Post
• https://twitter.com/CVEnew/status/1921398591085552003 · Twitter Post