CVE-2025-47828: @lumieducation/h5p-server Fails to Sanitize Plain Text Strings

May 11, 2025 (updated May 12, 2025)

Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.

References

github.com/Lumieducation/H5P-Nodejs-library
github.com/Lumieducation/H5P-Nodejs-library/compare/v9.3.2...v9.3.3
github.com/Lumieducation/H5P-Nodejs-library/pull/3894
github.com/advisories/GHSA-m7gm-v253-56hh
nvd.nist.gov/vuln/detail/CVE-2025-47828

Code Behaviors & Features

Detect and mitigate CVE-2025-47828 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →