This vulnerability in the h5p-nodejs-library allows attackers to upload H5P content containing malicious JavaScript code. When other users view this content, the embedded script executes in their browsers, constituting a stored XSS attack. The issue is due to improper neutralization of input during web page generation, categorized under CWE-79 and CWE-20. The affected versions are all versions prior to 10.0.4 inclusive. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation results in execution of attacker-controlled JavaScript in the context of users viewing the malicious H5P content. This can lead to session hijacking, unauthorized actions, or other impacts typical of stored XSS vulnerabilities. The CVSS 4.0 base score is 5.2 (medium severity), reflecting network attack vector, low attack complexity, and user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict uploading of untrusted H5P content and apply any available input sanitization or content filtering measures to mitigate risk.