GitHub Advisoryadvisory · Packagist

GHSA-mhf6-pp52-8wqj Moodle Cross-site Scripting (XSS) vulnerability

HIGH Published 2026-02-03 Modified 2026-02-03 Official page ↗
Aliases
CVE-2025-67849
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-79
Reviewed
2026-02-03

Affected packages

• Packagist moodle/moodle: < 4.1.22 → fixed in 4.1.22 • Packagist moodle/moodle: >= 4.4.0-beta, < 4.4.12 → fixed in 4.4.12 • Packagist moodle/moodle: >= 4.5.0-beta, < 4.5.8 → fixed in 4.5.8 • Packagist moodle/moodle: >= 5.0.0-beta, < 5.0.4 → fixed in 5.0.4 • Packagist moodle/moodle: >= 5.1.0-beta, < 5.1.1 → fixed in 5.1.1

Description

A flaw was found in Moodle. This Cross-site Scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References