CVE-2025-47828: 
JavaScript vulnerability analysis and mitigation

Lumi H5P-Nodejs-library before version 9.3.3 contains a security vulnerability identified as CVE-2025-47828. The vulnerability was discovered and disclosed on May 10, 2025, and involves a security issue where the library omits a sanitizeHtml call for plain text strings (NVD, CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting). It has been assigned a CVSS v3.1 base score of 6.4 (MEDIUM) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The technical issue stems from the omission of HTML sanitization for plain text strings in the library (Wiz).

The vulnerability could potentially lead to Cross-site Scripting (XSS) attacks due to the lack of proper HTML sanitization for plain text strings. This could allow attackers to execute malicious scripts in the context of the application (Wiz).

The vulnerability has been fixed in version 9.3.3 of the Lumi H5P-Nodejs-library. Users should upgrade to this version or later to address the security issue. The fix includes implementing proper sanitization for plain text strings (Github Compare, Github PR).