A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content.
At the time of publication, no release fully prevents the upload and execution of files that contain JavaScript. Version 10.0.4 removes the SVG file extension from the default content allowlist, but it still identifies permitted files by their filename extension alone. An attacker can therefore upload a file with malicious JavaScript content under an allowed extension, such as XML, and have it executed.
Until a complete fix is available, operators should not rely on extension-based filtering alone. Uploaded files should be validated and sanitized based on their actual content rather than their filename. For SVG uploads specifically, the library's SVG file sanitization can be enabled, which uses DOMPurify to remove malicious script content from uploaded files.