Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education
Priority LOW 24CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0046 40th percentileScored 2026-11-07
Fix Fixed h5p-nodejs-library (Lumi Education UG): 10.0.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lumi Education UG | h5p-nodejs-library | before 10.0.4 | 10.0.4 | Patch available | CNA |
- h5p-nodejs-library VendorLumi Education UG Affected before 10.0.4 Fixed in 10.0.4 Patch available CNA
Remediation
- Fix · CNA h5p-nodejs-library (Lumi Education UG) Fixed in 10.0.4
Timeline
- 2026-10-02 Threatist record created from CVE-2025-7062
- 2026-10-03 Alias added: GHSA-9248-q3fg-hqmh
References
Sources
- CVE-2025-7062 · CVE Program
- CVE-2025-7062 · NVD
- FIRST EPSS
- GHSA-9248-q3fg-hqmh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences