6.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-47828

CVE-2025-47828: @lumieducation/h5p-server Fails to Sanitize Plain Text Strings

Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-47828

CVE-2025-47828:

6.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@lumieducation/h5p-server	npm	< 9.3.3	9.3.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description states that the Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings. I analyzed the pull request associated with the fix (PR #3894) and its commits. The key commit is 77649fca644d5573e97c3355aa41a25827b789b8, which modifies packages/h5p-server/src/SemanticsEnforcer.ts. The patch introduces an else block that calls sanitizeHtml(newText). By examining the code structure of SemanticsEnforcer.ts from a version before the patch (e.g., v9.3.2), I identified that this change occurs within the enforceSemanticsRecursive method of the SemanticsEnforcer class. This method processes input based on semantic definitions. The vulnerability existed because, for text fields that didn't match specific, more complex HTML profiles (like those allowing only certain tags like 'p', 'br', 'strong', etc.), the input string (newText) was not passed through any sanitization function before further processing or assignment. This lack of sanitization in a specific code path within enforceSemanticsRecursive is the core of the vulnerability. The other commits in the PR were related to test adjustments and CI configuration changes, not directly to the vulnerable code logic itself.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.