CVE-2025-7062: h5p-nodejs-library Stored XSS Vulnerability

CVE-2025-7062 Overview

CVE-2025-7062 is a stored cross-site scripting (XSS) vulnerability in the h5p-nodejs-library maintained by Lumi Education UG. The flaw affects versions up to and including 10.0.4. The library accepts uploaded H5P content packages that can embed attacker-controlled JavaScript. When another user opens the affected H5P content, the injected script executes in that user's browser session. The root weakness is classified as improper input validation [CWE-20], allowing unsanitized payloads to persist and later render in the victim context.

Critical Impact
Authenticated users who can upload H5P content can plant persistent JavaScript that runs in every subsequent viewer's browser, enabling session theft, UI redressing, and lateral actions against integrating applications.

Affected Products

h5p-nodejs-library by Lumi Education UG, versions up to and including 10.0.4
Web applications that embed the vulnerable h5p-nodejs-library to render user-supplied H5P content
Learning platforms and LMS integrations relying on the affected library for H5P playback

Discovery Timeline

2026-09-09 - CVE-2025-7062 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2025-7062

Vulnerability Analysis

H5P is a packaging format for interactive HTML5 content. The h5p-nodejs-library handles parsing, storage, and serving of these packages on the server side. In affected versions, the library does not adequately validate or sanitize script-bearing fields inside uploaded H5P bundles. As a result, JavaScript embedded in the content persists in storage and is later served to viewers with the trust context of the hosting application.

Exploitation requires an account with permission to upload H5P content and requires a victim to open the malicious content. Once triggered, the script runs in the origin of the hosting site. Attackers can read session cookies not marked HttpOnly, issue authenticated requests, modify displayed content, and pivot to other application functionality accessible to the victim.

Root Cause

The vulnerability stems from improper input validation of user-controlled fields within H5P content packages. The library treats attacker-supplied values as trusted markup rather than escaping them prior to rendering. Because the payload is stored server-side and served to any subsequent viewer, the impact is persistent rather than reflected.

Attack Vector

An authenticated attacker uploads a crafted H5P package containing JavaScript inside a field that the client renders without proper encoding. The malicious content is stored by the application. When another user views the H5P item, the browser executes the attacker's script under the site's origin. This delivers stored XSS with cross-user reach and low complexity.

See the Schutzwerk Security Advisory SA-2024-007 for technical details on the injection surface and payload structure.

Detection Methods for CVE-2025-7062

Indicators of Compromise

H5P content packages containing inline <script> tags, javascript: URIs, or event handler attributes such as onerror, onload, or onclick in stored fields
Outbound browser requests from viewer sessions to unexpected domains shortly after loading H5P content
Unexpected session token or credential submissions originating from pages that render H5P material

Detection Strategies

Scan stored H5P packages and their extracted JSON metadata for HTML tags, script constructs, and encoded payloads that survive the library's sanitization routines
Enable Content Security Policy (CSP) violation reporting on pages that embed H5P content to surface inline script execution attempts
Review upload logs to correlate H5P uploads with subsequent anomalous client-side activity from viewer accounts

Monitoring Recommendations

Track versions of h5p-nodejs-library in your dependency inventory and alert on any instance at or below 10.0.4
Monitor web application logs for authenticated H5P upload activity, particularly from lower-privilege roles
Instrument the browser session boundary with CSP report-only rules to identify script violations before enforcing blocking policies

How to Mitigate CVE-2025-7062

Immediate Actions Required

Upgrade h5p-nodejs-library to a version above 10.0.4 that includes the fix referenced in the GitHub H5P Node.js Library release notes
Audit existing H5P content stores for previously uploaded packages containing script payloads and quarantine suspect items
Restrict H5P upload permissions to trusted roles until patching is complete

Patch Information

Lumi Education has released updates to h5p-nodejs-library addressing the stored XSS. Refer to the H5P Node.js Library release page for the fixed versions and integrate the update through your standard dependency management workflow. Rebuild and redeploy any application containers that bundle the library.

Workarounds

Apply a strict Content Security Policy that disallows inline scripts and restricts script sources on pages rendering H5P content
Temporarily disable H5P uploads or gate them behind manual review until the patched library version is deployed
Enforce the HttpOnly and Secure flags on session cookies to reduce the value of any script-based token theft

bash

# Update the vulnerable dependency to a fixed release
npm install @lumieducation/h5p-server@latest
npm audit