medium6.4
CVE-2025-47828
@lumieducation/h5p-server Fails to Sanitize Plain Text Strings
Impact
Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @lumieducation/h5p-server | < 9.3.3 | 9.3.3 |
Affected products
| Product | Affected versions |
|---|---|
| Lumi H5P-Nodejs-Library | before 9.3.3 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/Lumieducation/H5P-Nodejs-library/compare/v9.3.2...v9.3.3
- https://github.com/Lumieducation/H5P-Nodejs-library/pull/3894
- http://seclists.org/fulldisclosure/2026/Sep/69
- https://github.com/advisories/GHSA-m7gm-v253-56hh
- https://nvd.nist.gov/vuln/detail/CVE-2025-47828