Stored cross-site scripting in Lumi Education UG h5p-nodejs-library

A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.

• h5p-nodejs-library by Lumi Education UG: the record description identifies versions up to and including 10.0.4 as affected. • The structured affected data in the record separately encodes less than 10.0.4, so the exact boundary at 10.0.4 is inconsistent and should be reconciled against deployment or vendor information. • The vendor release notes state that 10.0.4 removes the SVG extension from the default content allowlist and adds SVG file sanitization, but the supplied solution states that this release still relies on filename extensions and does not fully prevent the upload and execution of JavaScript. • The status of other branches or releases is not established by the available evidence.

Lumi Education UG's h5p-nodejs-library accepts H5P content uploads, and an uploader can place malicious JavaScript in the uploaded content. The library stores that content and later renders it when another user views the affected H5P item, causing the script to execute in that user's browser. The weakness is improper neutralization of input during web page generation, with improper input validation as a contributing class. The supplied mitigation text says file acceptance is based on filename extensions rather than actual content, so a file using an allowed extension such as XML can still contain JavaScript. The exact rendering path and the server-side component responsible for the final execution are not established by the available evidence. The normalized attack characteristics indicate network reachability, low required privileges, and active interaction by a user who views the content.

The vulnerability can be reached over the network in deployments that allow a low-privilege user to upload H5P content. An attacker must place malicious JavaScript in an accepted H5P file, and another user must open or view the affected content for the code to execute. The attack complexity is characterized as low, but interaction by the victim-side user is required. The supplied evidence does not confirm exploitation in the wild and does not identify a specific public exploit.

The immediate technical effect is script execution in the browser of each user who views malicious H5P content. Depending on the victim's session and permissions, the script could potentially read or modify data available to that user or perform actions in the application's context; these are possible consequences, not outcomes confirmed by the record. Because the payload is stored, multiple users may be affected when they view the same content. The available evidence does not establish server-side code execution, database compromise, or a direct availability impact on the server.

Organizations using h5p-nodejs-library for online learning or shared content should check deployments that allow untrusted or lower-privilege users to upload H5P. A malicious H5P item can persist and execute in viewers' browsers, creating risks to content trust, user support, and incident response operations. Depending on the viewer's permissions, browser-side script could potentially access or alter information available to that user through the application, but the evidence does not establish a breach or a specific victim. Mitigation may require review of existing content and changes to upload validation and sanitization.

1. Do not rely on filename-extension filtering alone. Validate and sanitize uploaded files based on their actual content before allowing them to be stored or rendered.
2. For SVG uploads, enable the library's SVG file sanitization, which uses DOMPurify to remove malicious script content.
3. If 10.0.4 is deployed, treat it as a partial mitigation rather than a complete fix. It removes SVG from the default allowlist, but extension-only identification can still be bypassed by placing JavaScript content in an allowed extension such as XML.
4. Review any custom contentWhitelist because local configuration may re-allow SVG or other file types that require sanitization.
5. Track vendor updates for a release that fully addresses the issue. The available evidence does not identify such a complete release.

1. Inventory deployments using h5p-nodejs-library and identify the installed version, upload configuration, and any custom contentWhitelist settings.
2. Check whether file filtering relies only on filename extensions or whether uploaded content is validated and sanitized based on its actual content.
3. Review SVG handling and confirm whether the library's SVG file sanitization based on DOMPurify is enabled.
4. Review application records for H5P upload activity followed by views of the uploaded content, where such records exist. This is a precautionary review, not a confirmed IOC.
5. Use an approved security test procedure to verify that script-bearing files cannot be stored and rendered as valid H5P content.