Lumi H5P-Nodejs-library before 9.3.3 omits a sanitizeHtml call for plain text strings.

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2025-47828 · CVE overview and exploitation status

EUVD-2025-14282

GHSA-m7gm-v253-56hh

cve-program · CVE-2025-47828

• https://github.com/Lumieducation/H5P-Nodejs-library/compare/v9.3.2...v9.3.3
• https://github.com/Lumieducation/H5P-Nodejs-library/pull/3894

euvd · EUVD-2025-14282

• https://github.com/Lumieducation/H5P-Nodejs-library/compare/v9.3.2...v9.3.3
• https://github.com/Lumieducation/H5P-Nodejs-library/pull/3894

nvd · CVE-2025-47828

• https://github.com/Lumieducation/H5P-Nodejs-library/compare/v9.3.2...v9.3.3
• https://github.com/Lumieducation/H5P-Nodejs-library/pull/3894
• http://seclists.org/fulldisclosure/2026/Sep/69

osv · GHSA-m7gm-v253-56hh

• https://nvd.nist.gov/vuln/detail/CVE-2025-47828
• https://github.com/Lumieducation/H5P-Nodejs-library/pull/3894
• https://github.com/Lumieducation/H5P-Nodejs-library
• https://github.com/Lumieducation/H5P-Nodejs-library/compare/v9.3.2...v9.3.3

No related changes are available here.