CVE-2025-67849 PUBLISHED

Moodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responses

Assigner: fedora
Reserved: 12.12.2025 Published: 03.02.2026 Updated: 03.02.2026

A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS Score: 7.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Package Collection	https://github.com/moodle/moodle/
Package Name	moodle
Versions	Default: unaffected affected from 4.5.0 to 4.5.8 (excl.) affected from 5.0.0 to 5.0.4 (excl.) affected from 5.1.0 to 5.1.1 (excl.)

Credits

Red Hat would like to thank Vuln37 for reporting this issue.

References

Problem Types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE