Executive brief
H5P-Nodejs-Library is a Node.js framework for creating and serving interactive educational content. A stored cross-site scripting vulnerability allows attackers to upload H5P content with malicious JavaScript that executes in other users' browsers when they view the content, potentially leading to session hijacking, account takeover, and privilege escalation if administrative users are targeted.
Technical details
A stored XSS vulnerability exists in H5P-Nodejs-Library due to insufficient input validation and sanitization of uploaded H5P content files. The vulnerability arises from the library's reliance on filename extension-based filtering (allowlist) rather than content-based validation. Attackers with upload privileges can craft malicious SVG files (or files with other permitted extensions) containing embedded JavaScript and include them in H5P archives. When other users open the uploaded content, particularly by viewing embedded media in a separate browser tab, the malicious scripts execute with the victim's privileges, allowing cookie theft, session hijacking, and account compromise. While version 10.0.4 introduces a sanitizer interface and removes SVG from the default allowlist, the vulnerability persists because the allowlist approach does not prevent uploading files with XSS payloads under permitted extensions (e.g., XML). A complete fix requires content-based validation and sanitization (e.g., using DOMPurify for SVG) rather than extension-based filtering alone.
Affected products
- Lumi Education UG H5P-Nodejs-Library up to and including 10.0.4
Timeline
- 2024-10-23: disclosed: Vulnerability discovered
- 2025-03-07: advisory: Version 10.0.4 released with file sanitization interface but incomplete fix
- 2026-09-09: advisory: Public disclosure via SCHUTZWERK-SA-2024-007