Nixpkgs security tracker

Untriaged

Permalink CVE-2025-67849

7.3 HIGH

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): NONE

created 2 months, 1 week ago

Moodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responses

A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.

References

https://access.redhat.com/security/cve/CVE-2025-67849 vdb-entryx_refsource_REDHAT
RHBZ#2423835 x_refsource_REDHATissue-tracking
https://access.redhat.com/security/cve/CVE-2025-67849 vdb-entryx_refsource_REDHAT
RHBZ#2423835 x_refsource_REDHATissue-tracking

Affected products

moodle

<4.5.8
<5.1.1
<5.0.4

Matching in nixpkgs

pkgs.moodle

Free and open-source learning management system (LMS) written in PHP

nixos-unstable 5.0.1
- nixpkgs-unstable 5.0.4
- nixos-unstable-small 5.1.1
nixos-25.11 5.0.4

pkgs.moodle-dl

Moodle downloader that downloads course content fast from Moodle

nixos-unstable 2.3.13
- nixpkgs-unstable 2.3.13
- nixos-unstable-small 2.3.13
nixos-25.11 2.3.13

Package maintainers