CVE-2025-47828: @lumieducation/h5p-server Fails to Sanitize Plain Text Strings

May 11, 2025 (updated May 12, 2025)

Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.

References

github.com/Lumieducation/H5P-Nodejs-library
github.com/Lumieducation/H5P-Nodejs-library/compare/v9.3.2...v9.3.3
github.com/Lumieducation/H5P-Nodejs-library/pull/3894
github.com/advisories/GHSA-m7gm-v253-56hh
nvd.nist.gov/vuln/detail/CVE-2025-47828

Code Behaviors & Features

Detect and mitigate CVE-2025-47828 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →