Nixpkgs Security Tracker

Untriaged

Permalink CVE-2025-67849

created 21 hours ago

Moodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responses

A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface could be manipulated.

Affected products

moodle

<5.0.4
<5.1.1
<4.5.8

Matching in nixpkgs

pkgs.moodle

Free and open-source learning management system (LMS) written in PHP

nixos-unstable 5.1.1
- nixpkgs-unstable 5.0.4
- nixos-unstable-small 5.1.1
nixos-25.11 -
- nixos-25.11-small 5.0.4
- nixpkgs-25.11-darwin 5.0.4
nixos-25.05 5.0
- nixos-25.05-small 5.0
- nixpkgs-25.05-darwin 5.0

pkgs.moodle-dl

Moodle downloader that downloads course content fast from Moodle

nixos-unstable 2.3.13
- nixpkgs-unstable 2.3.13
- nixos-unstable-small 2.3.13
nixos-25.11 -
- nixos-25.11-small 2.3.13
- nixpkgs-25.11-darwin 2.3.13
nixos-25.05 2.3.13
- nixos-25.05-small 2.3.13
- nixpkgs-25.05-darwin 2.3.13

Package maintainers

@freezeboy freezeboy
@kmein Kierán Meinhardt <kmein@posteo.de>

Suggestion detail

Affected products

Matching in nixpkgs

pkgs.moodle

pkgs.moodle-dl

Package maintainers