CVE-2025-67849: Moodle AI Prompt XSS Vulnerability

CVE-2025-67849 Overview

A cross-site scripting (XSS) vulnerability has been identified in Moodle, the widely-used open-source learning management system. The flaw stems from improper sanitization of AI prompt responses, which allows attackers to inject malicious HTML or JavaScript code into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated to perform unauthorized actions.

Critical Impact

Authenticated attackers can inject malicious scripts that execute in victims' browsers, potentially leading to session hijacking, credential theft, or unauthorized actions within the Moodle platform.

Affected Products

• Moodle Learning Management System (specific versions not disclosed)

Discovery Timeline

• 2026-02-03 - CVE-2025-67849 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-67849

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). The flaw exists in the handling of AI prompt responses within Moodle's interface. When AI-generated content is rendered on web pages, the application fails to properly sanitize or encode the output, allowing malicious actors to embed executable scripts within the responses.

The attack requires network access and low-level authenticated privileges to exploit. User interaction is required, as a victim must view the compromised page for the malicious payload to execute. Once triggered, the vulnerability can lead to high confidentiality and integrity impacts, enabling attackers to access sensitive session data, perform actions on behalf of authenticated users, or manipulate the displayed content.

Root Cause

The root cause of this vulnerability is insufficient output encoding and sanitization of AI-generated content before it is rendered in the browser. Moodle's integration with AI features does not adequately validate or escape special HTML characters and JavaScript code that may be present in AI prompt responses. This allows user-controlled or AI-generated input to be interpreted as executable code rather than plain text.

Attack Vector

The attack leverages the network-accessible Moodle web interface. An authenticated attacker with low-level privileges can craft or manipulate AI prompts to generate responses containing malicious payloads. The injection point exists where AI-generated content is displayed to users without proper encoding.

When a victim navigates to a page containing the compromised AI response, the malicious script executes within their browser context. This enables the attacker to steal session cookies, capture keystrokes, redirect users to phishing pages, or perform actions within Moodle using the victim's authenticated session.

The vulnerability mechanism involves AI prompt responses being rendered directly in the DOM without proper sanitization. When the response content contains script tags or event handlers, these are executed in the context of the user's authenticated session. For detailed technical information, refer to the Red Hat CVE-2025-67849 Advisory.

Detection Methods for CVE-2025-67849

Indicators of Compromise

• Unusual JavaScript code or HTML tags present in AI-generated content or database records
• Unexpected session activity or access patterns from users who recently viewed AI-enhanced pages
• Browser security warnings or Content Security Policy (CSP) violation reports related to inline scripts
• Log entries showing suspicious characters or script tags in AI prompt submissions

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS payload patterns in requests and responses
• Enable Content Security Policy (CSP) headers with strict directives to prevent inline script execution
• Deploy SentinelOne Singularity Platform to monitor for browser-based attacks and suspicious JavaScript execution
• Review Moodle application logs for AI prompt requests containing potential XSS vectors such as <script>, javascript:, or event handlers

Monitoring Recommendations

• Monitor user session activity for anomalies following interaction with AI-powered features
• Implement real-time alerting for CSP violations that may indicate XSS exploitation attempts
• Track authentication events and privilege changes that occur after users access AI-generated content
• Utilize SentinelOne's behavioral AI to detect post-exploitation activities such as credential harvesting or lateral movement

How to Mitigate CVE-2025-67849

Immediate Actions Required

• Apply security patches from Moodle as soon as they become available
• Implement strict Content Security Policy (CSP) headers to mitigate the impact of XSS vulnerabilities
• Review and audit AI integration features for proper input/output encoding
• Consider temporarily disabling AI prompt features until patches are applied if risk tolerance is low

Patch Information

Monitor the Red Hat CVE-2025-67849 Advisory and official Moodle security announcements for patch availability. The Red Hat Bug Report #2423835 provides additional tracking information for this vulnerability.

Workarounds

• Deploy a Web Application Firewall (WAF) with XSS protection rules enabled
• Implement strict Content Security Policy headers to prevent inline script execution
• Limit access to AI-enhanced features to trusted users until patches are available
• Enable HTTPOnly and Secure flags on session cookies to reduce the impact of potential session theft

# Example Apache configuration for Content Security Policy
# Add to your Moodle virtual host configuration
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"

# Enable HTTPOnly and Secure flags for cookies
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure;SameSite=Strict