CVE-2025-7062

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.

CVSS

No CVSS.

References

Link	Resource
https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4
https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/
http://seclists.org/fulldisclosure/2026/Sep/41

Configurations

No configuration.

History

19 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de Cross-site Scripting (XSS) almacenada ha sido identificada en el módulo H5P ’h5p-nodejs-library’ de Lumi Education UG en versiones hasta e incluyendo 10.0.4. La biblioteca permite a los usuarios subir contenido H5P que contiene JavaScript malicioso. Este código se ejecuta en los navegadores de otros usuarios que visualizan el contenido H5P afectado.

22 Sep 2026, 19:16

Type	Values Removed	Values Added
References		() http://seclists.org/fulldisclosure/2026/Sep/41 -

Information

Published : 2026-09-09 07:16

Updated : 2026-10-19 22:10

NVD link : CVE-2025-7062

Mitre link : CVE-2025-7062

CVE.ORG link : CVE-2025-7062

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-7062", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7062", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-09T20:30:55.655255Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423", "affectedData": [{"repo": "https://github.com/Lumieducation/H5P-Nodejs-library", "vendor": "Lumi Education UG", "modules": ["Import of H5P modules"], "product": "h5p-nodejs-library", "versions": [{"status": "affected", "version": "0", "lessThan": "10.0.4", "versionType": "custom"}], "packageName": "h5p-nodejs-library", "programFiles": ["packages/h5p-server/src/H5PEditor.ts"], "defaultStatus": "unknown"}]}], "published": "2026-09-09T07:16:55.180", "references": [{"url": "https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v10.0.4", "source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423"}, {"url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/", "source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423"}, {"url": "http://seclists.org/fulldisclosure/2026/Sep/41", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content."}, {"lang": "es", "value": "Una vulnerabilidad de Cross-site Scripting (XSS) almacenada ha sido identificada en el m\u00f3dulo H5P \u2019h5p-nodejs-library\u2019 de Lumi Education UG en versiones hasta e incluyendo 10.0.4. La biblioteca permite a los usuarios subir contenido H5P que contiene JavaScript malicioso. Este c\u00f3digo se ejecuta en los navegadores de otros usuarios que visualizan el contenido H5P afectado."}], "lastModified": "2026-10-19T22:10:00.130", "sourceIdentifier": "23637b5d-af4c-4cf9-b8f6-deb7fd0f8423"}