Moodle Cross-site Scripting (XSS) vulnerability
Impact
A flaw was found in Moodle. This Cross-site Scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 4.1.22Ecosystem versions | 4.1.22 |
| From 4.4.0-beta before 4.4.12Ecosystem versions | 4.4.12 |
| From 4.5.0-beta before 4.5.8Ecosystem versions | 4.5.8 |
| From 5.0.0-beta before 5.0.4Ecosystem versions | 5.0.4 |
| From 5.1.0-beta before 5.1.1Ecosystem versions | 5.1.1 |
Version evidence: OSV · GHSA-mhf6-pp52-8wqj
View original version evidence (392 explicit versions)
Original source description
A flaw was found in Moodle. This Cross-site Scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2025-67849
- Patch github.com/moodle/moodle/commit/a3063dcaa44dbe66e60a37cadb33bfadfe4feb03
- Security advisory access.redhat.com/security/cve/CVE-2025-67849
- Source reference bugzilla.redhat.com/show_bug.cgi
- Source reference github.com/moodle/moodle
- Source reference moodle.org/mod/forum/discuss.php