From 951f11d3132c6a26299ea79c131d65aa59a55202 Mon Sep 17 00:00:00 2001
From: erseco <info@ernesto.es>
Date: Fri, 5 Jun 2026 17:40:57 +0100
Subject: [PATCH 1/3] fix(security): resolve 82 CodeQL code-scanning alerts

Fix the safe, mechanical security-warning classes flagged by CodeQL across
the backend, frontend, iDevice runtimes, exporters and legacy importers.
Every change is minimal and behaviour-preserving, with a colocated test.

- double-escaping: decode &amp; last so &amp;lt; no longer collapses to <
- incomplete-(multi-character-)sanitization: loop tag/handler strips to a
  fixed point; add global flags; escape backslash before the delimiter
- bad-tag-filter: tolerant </script > end-tag regex (whitespace/newline/case)
- incomplete-url-scheme-check: also reject vbscript:/data: (entity/ws tolerant)
- incomplete-url-substring-sanitization: new URL() exact host/path checks
- prototype-pollution: guard __proto__/prototype/constructor in deep-merge
- cross-window-information-leak: drop postMessage('*') fallback
- insecure-randomness: Web Crypto instead of the non-crypto PRNG
- insecure-download / functionality-from-untrusted-source: scheme validation, SRI
- overly-large-range: narrow [a-zA-z] to [a-zA-Z] (export + edition twins)
- actions/missing-workflow-permissions: least-privilege permissions block

Guards a RangeError in the numeric-entity decoder and keeps the slide SVG
scrubber's src/export twins in sync. 2 stored-xss (inert DOMParser round-trip)
and 4 url-substring alerts inside test bodies are skipped with documented
rationale. The 146 js/xss-through-dom alerts in iDevice rendering are deferred.
---
 .github/workflows/e2e-db-matrix.yml           |   3 +
 public/app/adapters/LinkValidationAdapter.js  |  48 ++++++-
 .../adapters/LinkValidationAdapter.test.js    |  67 +++++++++
 public/app/common/LatexPreRenderer.js         |  38 +++--
 public/app/common/LatexPreRenderer.test.js    |  72 ++++++++++
 public/app/common/common.js                   |  58 ++++++--
 public/app/common/common.test.js              |  56 ++++++++
 public/app/common/mindmaps/src/index.html     |   2 +-
 public/app/core/EmbeddingBridge.js            |   9 +-
 public/app/core/EmbeddingBridge.test.js       |  33 +++--
 public/app/locate/locale.js                   |  21 ++-
 public/app/locate/locale.test.js              |  61 ++++++++
 .../interface/elements/previewPanel.js        |   2 +-
 .../interface/elements/previewPanel.test.js   |  22 +++
 public/app/yjs/AssetManager.js                |   9 +-
 public/app/yjs/AssetManager.test.js           |  20 +++
 public/app/yjs/ResourceFetcher.js             |  27 ++++
 public/app/yjs/ResourceFetcher.test.js        |  74 +++++++++-
 public/app/yjs/YjsProjectBridge.js            |  28 +++-
 public/app/yjs/YjsProjectBridge.test.js       |  38 +++++
 .../edition/adaptative-quiz.js                |  13 +-
 .../edition/adaptative-quiz.test.js           |  29 ++++
 .../base/az-quiz-game/edition/az-quiz-game.js |  15 +-
 .../az-quiz-game/edition/az-quiz-game.test.js |  61 +++++++-
 .../base/crossword/edition/crossword.js       |  20 ++-
 .../base/crossword/edition/crossword.test.js  |  29 ++++
 .../base/discover/edition/discover.js         |  14 +-
 .../base/discover/edition/discover.test.js    |  86 ++++++++++-
 .../base/dragdrop/edition/dragdrop.js         |   4 +-
 .../base/dragdrop/edition/dragdrop.test.js    |  29 ++++
 .../edition/electrical-circuits.js            |  16 ++-
 .../edition/electrical-circuits.test.js       | 118 ++++++++++++++++
 .../base/flipcards/edition/flipcards.js       |  19 ++-
 .../base/flipcards/edition/flipcards.test.js  |  79 +++++++++++
 .../perm/idevices/base/guess/edition/guess.js |  14 +-
 .../idevices/base/guess/edition/guess.test.js |  59 ++++++++
 .../edition/interactive-video.js              |  19 ++-
 .../edition/interactive-video.test.js         |  22 +++
 .../export/interactive-video.js               |  38 ++++-
 .../export/interactive-video.test.js          | 126 +++++++++++++++++
 .../base/mathproblems/edition/mathproblems.js |   2 +-
 .../base/mathproblems/export/mathproblems.js  |   2 +-
 .../mathproblems/export/mathproblems.test.js  |  58 ++++++++
 .../export/quick-questions-video.js           |  25 ++--
 .../export/quick-questions-video.test.js      | 133 ++++++++++++++++++
 .../idevices/base/relate/edition/relate.js    |  34 +++--
 .../base/relate/edition/relate.test.js        | 124 ++++++++++++++++
 .../perm/idevices/base/slide/export/slide.js  |  34 ++++-
 .../idevices/base/slide/export/slide.test.js  |  38 +++++
 .../idevices/base/slide/src/sanitizer.test.js |  36 +++++
 .../perm/idevices/base/slide/src/sanitizer.ts |  32 ++++-
 .../edition/three-sixty-viewer.js             |   8 +-
 .../edition/three-sixty-viewer.test.js        |  28 ++++
 .../idevices/base/trivial/edition/trivial.js  |  25 +++-
 .../base/trivial/edition/trivial.test.js      |  74 ++++++++++
 .../base/udl-content/edition/udl-content.js   |  25 ++--
 .../udl-content/edition/udl-content.test.js   | 113 +++++++++++++++
 .../base/word-search/edition/word-search.js   |  16 ++-
 .../word-search/edition/word-search.test.js   | 116 +++++++++++++++
 scripts/static-bundle/static-index.html       |  16 +--
 src/cli/commands/translations.spec.ts         |  28 ++++
 src/cli/commands/translations.ts              |   4 +-
 src/cli/commands/update-licenses.spec.ts      |  18 +++
 src/cli/commands/update-licenses.ts           |  14 +-
 src/routes/project.spec.ts                    |  56 +++++++-
 src/routes/project.ts                         |  28 +++-
 src/services/folder-manager.spec.ts           |  13 ++
 src/services/folder-manager.ts                |   7 +-
 src/services/link-validator.spec.ts           |  68 +++++++++
 src/services/link-validator.ts                |  31 +++-
 .../exporters/PrintPreviewExporter.spec.ts    |  28 +---
 .../export/generators/I18nGenerator.spec.ts   |  14 ++
 src/shared/export/generators/I18nGenerator.ts |   4 +-
 .../prerender/ServerLatexPreRenderer.spec.ts  |  40 +++++-
 .../prerender/ServerLatexPreRenderer.ts       |  18 ++-
 .../ServerMermaidPreRenderer.spec.ts          |  33 ++++-
 .../prerender/ServerMermaidPreRenderer.ts     |  14 +-
 src/shared/import/ElpxImporter.spec.ts        |  64 +++++++++
 src/shared/import/ElpxImporter.ts             |  13 +-
 src/shared/import/LegacyXmlParser.spec.ts     |  29 ++++
 src/shared/import/LegacyXmlParser.ts          |   4 +-
 .../legacy-handlers/BaseLegacyHandler.spec.ts |  34 +++++
 .../legacy-handlers/BaseLegacyHandler.ts      |  33 +++--
 .../import/legacy-handlers/GameHandler.ts     |  12 +-
 .../InteractiveVideoHandler.spec.ts           |  60 ++++++++
 .../InteractiveVideoHandler.ts                |   4 +-
 .../import/legacy-handlers/handlers.spec.ts   |  51 +++++++
 .../specs/idevices/image-gallery.spec.ts      |   6 +-
 .../latex-text-idevice-export.spec.ts         |   2 +-
 views/admin/index.njk                         |   2 +-
 90 files changed, 2925 insertions(+), 244 deletions(-)
 create mode 100644 public/files/perm/idevices/base/electrical-circuits/edition/electrical-circuits.test.js
 create mode 100644 public/files/perm/idevices/base/mathproblems/export/mathproblems.test.js
 create mode 100644 public/files/perm/idevices/base/quick-questions-video/export/quick-questions-video.test.js
 create mode 100644 public/files/perm/idevices/base/relate/edition/relate.test.js
 create mode 100644 public/files/perm/idevices/base/trivial/edition/trivial.test.js
 create mode 100644 public/files/perm/idevices/base/udl-content/edition/udl-content.test.js
 create mode 100644 public/files/perm/idevices/base/word-search/edition/word-search.test.js
 create mode 100644 src/shared/import/legacy-handlers/InteractiveVideoHandler.spec.ts

diff --git a/.github/workflows/e2e-db-matrix.yml b/.github/workflows/e2e-db-matrix.yml
index 43abebdd3d..3b6a8366fc 100644
--- a/.github/workflows/e2e-db-matrix.yml
+++ b/.github/workflows/e2e-db-matrix.yml
@@ -6,6 +6,9 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
diff --git a/public/app/adapters/LinkValidationAdapter.js b/public/app/adapters/LinkValidationAdapter.js
index adc912c1ef..ac3987cf4f 100644
--- a/public/app/adapters/LinkValidationAdapter.js
+++ b/public/app/adapters/LinkValidationAdapter.js
@@ -136,7 +136,8 @@ export default class LinkValidationAdapter {
 
     /**
      * Remove invalid/non-validatable links
-     * Filters out: empty, anchors (#), javascript:, data: URLs
+     * Filters out: empty, anchors (#), and dangerous script schemes
+     * (javascript:, vbscript:, data:).
      * @param {Array<{url: string, count: number}>} links
      * @returns {Array<{url: string, count: number}>}
      * @private
@@ -145,12 +146,53 @@ export default class LinkValidationAdapter {
         return links.filter((link) => {
             if (!link.url || link.url.trim() === '') return false;
             if (link.url.startsWith('#')) return false;
-            if (link.url.startsWith('javascript:')) return false;
-            if (link.url.startsWith('data:')) return false;
+            if (this._hasDangerousScheme(link.url)) return false;
             return true;
         });
     }
 
+    /**
+     * Detect whether a URL uses a dangerous script-bearing scheme
+     * (javascript:, vbscript:, data:).
+     *
+     * Normalizes the URL before matching so the check cannot be bypassed
+     * with mixed case, leading/embedded whitespace and control characters,
+     * or HTML character entities (e.g. "&#106;avascript:").
+     *
+     * @param {string} url
+     * @returns {boolean} true when the URL resolves to a dangerous scheme
+     * @private
+     */
+    _hasDangerousScheme(url) {
+        if (typeof url !== 'string') return false;
+
+        // Safely convert a numeric code point, returning '' for invalid or
+        // out-of-range values so String.fromCodePoint cannot throw a
+        // RangeError (e.g. on "&#x110000;" or "&#9999999999;"). Dropping such
+        // junk only makes scheme detection stricter, never weaker.
+        const safeFromCodePoint = (cp) =>
+            Number.isInteger(cp) && cp >= 0 && cp <= 0x10ffff ? String.fromCodePoint(cp) : '';
+
+        // Decode common HTML entities (named and numeric) so encoded
+        // schemes such as "java&#115;cript:" are caught.
+        let normalized = url.replace(/&#x([0-9a-f]+);?/gi, (_m, hex) =>
+            safeFromCodePoint(Number.parseInt(hex, 16)),
+        );
+        normalized = normalized.replace(/&#(\d+);?/g, (_m, dec) =>
+            safeFromCodePoint(Number.parseInt(dec, 10)),
+        );
+        const namedEntities = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", colon: ':', tab: '\t', newline: '\n' };
+        normalized = normalized.replace(/&(amp|lt|gt|quot|apos|colon|tab|newline);/gi, (_m, name) => namedEntities[name.toLowerCase()] ?? _m);
+
+        // Strip whitespace and control characters (incl. NUL and DEL) that
+        // browsers ignore when resolving the scheme, then lowercase for
+        // comparison. \x00-\x20 covers C0 controls + space; \x7f is DEL.
+        // eslint-disable-next-line no-control-regex
+        const stripped = normalized.replace(/[\x00-\x20\x7f]+/g, '').toLowerCase();
+
+        return stripped.startsWith('javascript:') || stripped.startsWith('vbscript:') || stripped.startsWith('data:');
+    }
+
     /**
      * Deduplicate links, keeping the one with highest count
      * @param {Array<{url: string, count: number}>} links
diff --git a/public/app/adapters/LinkValidationAdapter.test.js b/public/app/adapters/LinkValidationAdapter.test.js
index 4d2582faf9..08821dc3a2 100644
--- a/public/app/adapters/LinkValidationAdapter.test.js
+++ b/public/app/adapters/LinkValidationAdapter.test.js
@@ -432,6 +432,73 @@ describe('LinkValidationAdapter', () => {
                 expect(result.length).toBe(1);
                 expect(result[0].url).toBe('https://valid.com');
             });
+
+            it('should reject vbscript:, mixed-case, whitespace-prefixed and entity-encoded script schemes', () => {
+                const dangerous = [
+                    { url: 'vbscript:msgbox(1)', count: 1 },
+                    { url: 'VBScript:MsgBox(1)', count: 1 },
+                    { url: 'JavaScript:alert(1)', count: 1 },
+                    { url: '  javascript:alert(1)', count: 1 },
+                    { url: '\t\njavascript:alert(1)', count: 1 },
+                    { url: 'java\x00script:alert(1)', count: 1 },
+                    { url: 'DATA:text/html,<script>alert(1)</script>', count: 1 },
+                    { url: '&#106;avascript:alert(1)', count: 1 },
+                    { url: 'java&#115;cript:alert(1)', count: 1 },
+                ];
+                const result = adapter._removeInvalidLinks(dangerous);
+
+                expect(result).toEqual([]);
+            });
+
+            it('should preserve legitimate safe links', () => {
+                const safe = [
+                    { url: 'http://example.com', count: 1 },
+                    { url: 'https://example.com/page', count: 1 },
+                    { url: '//cdn.example.com/file.js', count: 1 },
+                    { url: 'images/photo.jpg', count: 1 },
+                    { url: 'mailto:user@example.com', count: 1 },
+                    { url: 'tel:+1234567890', count: 1 },
+                ];
+                const result = adapter._removeInvalidLinks(safe);
+
+                expect(result.map((l) => l.url)).toEqual([
+                    'http://example.com',
+                    'https://example.com/page',
+                    '//cdn.example.com/file.js',
+                    'images/photo.jpg',
+                    'mailto:user@example.com',
+                    'tel:+1234567890',
+                ]);
+            });
+        });
+
+        describe('_hasDangerousScheme', () => {
+            it('should detect dangerous schemes through obfuscation', () => {
+                expect(adapter._hasDangerousScheme('javascript:alert(1)')).toBe(true);
+                expect(adapter._hasDangerousScheme('vbscript:msgbox(1)')).toBe(true);
+                expect(adapter._hasDangerousScheme('data:text/html,abc')).toBe(true);
+                expect(adapter._hasDangerousScheme('  JAVASCRIPT:alert(1)')).toBe(true);
+                expect(adapter._hasDangerousScheme('&#106;avascript:alert(1)')).toBe(true);
+                expect(adapter._hasDangerousScheme('&#x6a;avascript:alert(1)')).toBe(true);
+            });
+
+            it('should not flag safe links and non-string input', () => {
+                expect(adapter._hasDangerousScheme('https://example.com')).toBe(false);
+                expect(adapter._hasDangerousScheme('images/photo.jpg')).toBe(false);
+                expect(adapter._hasDangerousScheme('mailto:user@example.com')).toBe(false);
+                expect(adapter._hasDangerousScheme(null)).toBe(false);
+            });
+
+            it('should not throw on out-of-range numeric entities', () => {
+                // String.fromCodePoint throws RangeError for code points > 0x10FFFF
+                // or negative; the guard must drop them instead of crashing.
+                expect(() => adapter._hasDangerousScheme('&#x110000;')).not.toThrow();
+                expect(() => adapter._hasDangerousScheme('&#9999999999;')).not.toThrow();
+                expect(adapter._hasDangerousScheme('&#x110000;')).toBe(false);
+                expect(adapter._hasDangerousScheme('&#9999999999;')).toBe(false);
+                // A real scheme padded with an out-of-range entity is still caught.
+                expect(adapter._hasDangerousScheme('&#x110000;javascript:alert(1)')).toBe(true);
+            });
         });
 
         describe('_deduplicateLinks', () => {
diff --git a/public/app/common/LatexPreRenderer.js b/public/app/common/LatexPreRenderer.js
index 467aa72dfe..3e7cb8e2eb 100644
--- a/public/app/common/LatexPreRenderer.js
+++ b/public/app/common/LatexPreRenderer.js
@@ -101,18 +101,26 @@
         let clean = latexWithHtml.replace(/<br\s*\/?>/gi, '\n');
 
         // Remove any other HTML tags FIRST (before decoding entities)
-        // This prevents decoded < and > from being mistaken for tags
-        clean = clean.replace(/<[^>]+>/g, '');
-
-        // Decode common HTML entities AFTER removing tags
+        // This prevents decoded < and > from being mistaken for tags.
+        // Apply repeatedly until the string stops changing so that removing one
+        // tag cannot splice two halves into a new tag (e.g. "<<a>b>" -> "b>").
+        let prevClean;
+        do {
+            prevClean = clean;
+            clean = clean.replace(/<[^>]+>/g, '');
+        } while (clean !== prevClean);
+
+        // Decode common HTML entities AFTER removing tags.
+        // Decode &amp; LAST so that an already-escaped sequence like "&amp;lt;"
+        // (the literal text "&lt;") does not get double-decoded into "<".
         clean = clean
             .replace(/&nbsp;/gi, ' ')
             .replace(/&lt;/g, '<')
             .replace(/&gt;/g, '>')
-            .replace(/&amp;/g, '&')
             .replace(/&quot;/g, '"')
             .replace(/&#(\d+);/g, (_, code) => String.fromCharCode(parseInt(code, 10)))
-            .replace(/&#x([a-fA-F0-9]+);/g, (_, code) => String.fromCharCode(parseInt(code, 16)));
+            .replace(/&#x([a-fA-F0-9]+);/g, (_, code) => String.fromCharCode(parseInt(code, 16)))
+            .replace(/&amp;/g, '&');
 
         return clean;
     }
@@ -689,7 +697,7 @@
     function isNumberedEquation(latex) {
         const envMatch = latex.match(/\\begin\{([^}*]+)\*?\}/);
         if (!envMatch) return false;
-        const envName = envMatch[1].replace('*', ''); // Remove * for unnumbered variants
+        const envName = envMatch[1].replace(/\*/g, ''); // Remove * for unnumbered variants
         return NUMBERED_EQUATION_ENVS.has(envName) && !envMatch[1].endsWith('*');
     }
 
@@ -762,6 +770,14 @@
      * @returns {Promise<{html: string, hasLatex: boolean, latexRendered: boolean, count: number}>}
      */
     async function preRenderPerIdevice(html, preserved) {
+        // Security note (stored-xss): DOMParser.parseFromString builds an INERT
+        // document - scripts are NOT executed here, the document is only used to
+        // locate and re-serialize content. The ONLY new HTML this routine injects
+        // back via innerHTML is the MathJax library-rendered <svg>/<math> wrapper
+        // produced by createRenderedWrapperHtml(), whose data-latex attribute is
+        // escaped through escapeHtmlAttribute(). Every other byte is a faithful
+        // round-trip of the author's own already-HTML content (the trusted source
+        // of their own page), so this transformation introduces no new XSS sink.
         const parser = new DOMParser();
         const doc = parser.parseFromString(html, 'text/html');
 
@@ -889,7 +905,13 @@
             return await preRenderPerIdevice(safeHtml, preserved);
         }
 
-        // Parse HTML into DOM (simple mode without iDevice scoping)
+        // Parse HTML into DOM (simple mode without iDevice scoping).
+        // Security note (stored-xss): identical reasoning to preRenderPerIdevice -
+        // the parsed document is INERT (no script execution), only used to find
+        // and re-serialize content. The single new HTML payload injected via
+        // innerHTML is the MathJax library-rendered <svg>/<math> wrapper with an
+        // escaped data-latex attribute; the remaining output is a faithful
+        // round-trip of the author's own already-HTML content.
         const parser = new DOMParser();
         const doc = parser.parseFromString(safeHtml, 'text/html');
 
diff --git a/public/app/common/LatexPreRenderer.test.js b/public/app/common/LatexPreRenderer.test.js
index 35478af576..18190e6fd1 100644
--- a/public/app/common/LatexPreRenderer.test.js
+++ b/public/app/common/LatexPreRenderer.test.js
@@ -252,6 +252,44 @@ describe('LatexPreRenderer', () => {
             expect(result).toContain('\\begin{aligned}');
             expect(result).toContain('x &= 1');
         });
+
+        // Security: incomplete-multi-character-sanitization (CodeQL).
+        // A single-pass tag strip can be defeated because removing one match
+        // can splice two halves into a NEW tag. The strip must run to a fixed
+        // point so no <script (case-insensitive) survives.
+        test('strips nested/obfuscated tags to a fixed point (no <script remains)', () => {
+            const input = 'a<scr<script>ipt>alert(1)</script>b';
+            const result = LatexPreRenderer._cleanLatexFromHtml(input);
+
+            // The security property: removing one tag must not splice halves into
+            // a surviving "<tag" sequence. No opening "<" of any tag may remain.
+            expect(result.toLowerCase()).not.toContain('<script');
+            expect(result).not.toContain('<');
+        });
+
+        test('strips doubly-nested broken tags without leaving an opening tag', () => {
+            const input = '<<a>b>x = 1<<img>src>';
+            const result = LatexPreRenderer._cleanLatexFromHtml(input);
+
+            // After fixed-point removal no opening "<" (start of a tag) may remain.
+            expect(result).not.toContain('<');
+            expect(result).toContain('x = 1');
+        });
+
+        // Security: double-escaping (CodeQL). Decoding &amp; must happen LAST so
+        // an already-escaped sequence like "&amp;lt;" (the literal text "&lt;")
+        // is not double-decoded into "<".
+        test('does not double-decode &amp;lt; into <', () => {
+            expect(LatexPreRenderer._cleanLatexFromHtml('&amp;lt;')).toBe('&lt;');
+        });
+
+        test('does not double-decode &amp;amp; into &amp;', () => {
+            expect(LatexPreRenderer._cleanLatexFromHtml('&amp;amp;')).toBe('&amp;');
+        });
+
+        test('still decodes a single &amp; to & (legitimate input preserved)', () => {
+            expect(LatexPreRenderer._cleanLatexFromHtml('a &amp;&amp; b')).toBe('a && b');
+        });
     });
 
     describe('preRender', () => {
@@ -421,6 +459,40 @@ describe('LatexPreRenderer', () => {
             expect(result.html).not.toContain('data-latex="\\[<br>');
         });
 
+        // Security: stored-xss (CodeQL) on the DOMParser round-trip.
+        // The only NEW HTML preRender injects is the MathJax library-rendered
+        // wrapper, with its data-latex attribute escaped via escapeHtmlAttribute().
+        // LaTeX that contains a quote/angle-bracket payload must be neutralised in
+        // the attribute (escaped), never emitted as a live attribute/tag.
+        test('escapes quote/angle payloads inside the injected math wrapper attribute', async () => {
+            const html = '<p>\\(x" onmouseover="alert(1)\\)</p>';
+            const result = await LatexPreRenderer.preRender(html);
+
+            expect(result.latexRendered).toBe(true);
+            // The injected wrapper is present and library-rendered.
+            expect(result.html).toContain('exe-math-rendered');
+            // The wrapper's own data-latex attribute (built by THIS file via
+            // escapeHtmlAttribute) must entity-escape the double quote so the
+            // payload cannot break out into a live onmouseover handler.
+            const dataLatexMatch = result.html.match(/data-latex="([^"]*)"/);
+            expect(dataLatexMatch).not.toBeNull();
+            expect(dataLatexMatch[1]).toContain('&quot; onmouseover=&quot;alert(1)');
+            expect(dataLatexMatch[1]).not.toContain('"');
+        });
+
+        test('does not introduce a new live <script> when rendering math (round-trip is inert)', async () => {
+            // Author text that merely *contains* an angle bracket near math; the
+            // serialized output must only add the escaped library-rendered wrapper,
+            // not synthesize an executable script element from the LaTeX payload.
+            const html = '<p>\\(a < b\\) end</p>';
+            const result = await LatexPreRenderer.preRender(html);
+
+            expect(result.latexRendered).toBe(true);
+            expect(result.html).toContain('exe-math-rendered');
+            // No script element fabricated from the math payload.
+            expect(result.html.toLowerCase()).not.toContain('<script');
+        });
+
         test('does NOT process LaTeX inside HTML attributes', async () => {
             // LaTeX in title attribute should NOT be processed
             const html = '<p><a href="#" title="Se escribe: \\( \\LaTeX \\)">\\(\\LaTeX\\)</a></p>';
diff --git a/public/app/common/common.js b/public/app/common/common.js
index 67f68b5324..1232ba8398 100644
--- a/public/app/common/common.js
+++ b/public/app/common/common.js
@@ -1728,15 +1728,27 @@ var $exeDevices = {
 
 
             media: {
+                isMediatecaHost: function (hostname) {
+                    return hostname === 'mediateca.educa.madrid.org';
+                },
+
                 extractURLGD: function (urlmedia) {
                     let sUrl = urlmedia;
 
-                    if (
-                        typeof urlmedia !== 'undefined' &&
-                        urlmedia.length > 0 &&
-                        urlmedia.toLowerCase().startsWith('https://drive.google.com') &&
-                        urlmedia.toLowerCase().includes('sharing')
-                    ) {
+                    let isGoogleDriveShare = false;
+                    if (typeof urlmedia !== 'undefined' && urlmedia.length > 0) {
+                        try {
+                            const parsed = new URL(urlmedia);
+                            isGoogleDriveShare =
+                                parsed.protocol === 'https:' &&
+                                parsed.hostname.toLowerCase() === 'drive.google.com' &&
+                                urlmedia.toLowerCase().includes('sharing');
+                        } catch (e) {
+                            isGoogleDriveShare = false;
+                        }
+                    }
+
+                    if (isGoogleDriveShare) {
                         sUrl = sUrl.replace(
                             /https:\/\/drive\.google\.com\/file\/d\/(.*?)\/.*?\?usp=sharing/g,
                             'https://docs.google.com/uc?export=open&id=$1'
@@ -1755,8 +1767,19 @@ var $exeDevices = {
                 getURLVideoMediaTeca: function (url) {
                     if (!url) return false;
 
-                    if (url.includes("https://mediateca.educa.madrid.org/video/")) {
-                        const id = url.split("https://mediateca.educa.madrid.org/video/")[1].split("?")[0];
+                    let parsed;
+                    try {
+                        parsed = new URL(url);
+                    } catch (e) {
+                        return false;
+                    }
+
+                    if (
+                        parsed.protocol === 'https:' &&
+                        this.isMediatecaHost(parsed.hostname) &&
+                        parsed.pathname.startsWith('/video/')
+                    ) {
+                        const id = parsed.pathname.slice('/video/'.length);
                         return `http://mediateca.educa.madrid.org/streaming.php?id=${id}`;
                     }
 
@@ -1766,11 +1789,22 @@ var $exeDevices = {
                 getURLAudioMediaTeca: function (url) {
                     if (!url) return false;
 
+                    let parsed;
+                    try {
+                        parsed = new URL(url);
+                    } catch (e) {
+                        return false;
+                    }
+
+                    if (parsed.protocol !== 'https:' || !this.isMediatecaHost(parsed.hostname)) {
+                        return false;
+                    }
+
                     let id = '';
-                    if (url.includes("https://mediateca.educa.madrid.org/audio/")) {
-                        id = url.split("https://mediateca.educa.madrid.org/audio/")[1].split("?")[0];
-                    } else if (url.includes("https://mediateca.educa.madrid.org/video/")) {
-                        id = url.split("https://mediateca.educa.madrid.org/video/")[1].split("?")[0];
+                    if (parsed.pathname.startsWith('/audio/')) {
+                        id = parsed.pathname.slice('/audio/'.length);
+                    } else if (parsed.pathname.startsWith('/video/')) {
+                        id = parsed.pathname.slice('/video/'.length);
                     } else {
                         return false;
                     }
diff --git a/public/app/common/common.test.js b/public/app/common/common.test.js
index 7311d44251..6765b6f3a0 100644
--- a/public/app/common/common.test.js
+++ b/public/app/common/common.test.js
@@ -1902,6 +1902,62 @@ describe('common.js $exeDevices', () => {
       expect(result).toContain('streaming.php');
     });
 
+    // Security: incomplete-url-substring-sanitization regression tests.
+    // Look-alike hosts and URLs that merely embed the trusted string must be rejected.
+    it('extractURLGD rejects look-alike Google Drive hostnames', () => {
+      const media = getMedia();
+      const evil = 'https://drive.google.com.evil.com/file/d/1234567890/view?usp=sharing';
+      expect(media.extractURLGD(evil)).toBe(evil);
+      const embedded = 'https://evil.com/?x=https://drive.google.com/file/d/1234567890/view?usp=sharing';
+      expect(media.extractURLGD(embedded)).toBe(embedded);
+    });
+
+    it('extractURLGD still transforms legitimate Google Drive sharing URLs', () => {
+      const media = getMedia();
+      const url = 'https://drive.google.com/file/d/1234567890/view?usp=sharing';
+      expect(media.extractURLGD(url)).toContain('docs.google.com');
+    });
+
+    it('extractURLGD returns original for invalid URL strings', () => {
+      const media = getMedia();
+      expect(media.extractURLGD('not a url sharing')).toBe('not a url sharing');
+    });
+
+    it('getURLVideoMediaTeca rejects look-alike mediateca hostnames', () => {
+      const media = getMedia();
+      expect(media.getURLVideoMediaTeca('https://mediateca.educa.madrid.org.evil.com/video/abc123')).toBe(false);
+      expect(media.getURLVideoMediaTeca('https://evil.com/?x=https://mediateca.educa.madrid.org/video/abc123')).toBe(
+        false,
+      );
+      expect(media.getURLVideoMediaTeca('not a url')).toBe(false);
+    });
+
+    it('getURLVideoMediaTeca accepts legitimate video URLs and preserves the id', () => {
+      const media = getMedia();
+      const result = media.getURLVideoMediaTeca('https://mediateca.educa.madrid.org/video/abc123?t=10');
+      expect(result).toBe('http://mediateca.educa.madrid.org/streaming.php?id=abc123');
+    });
+
+    it('getURLAudioMediaTeca rejects look-alike mediateca hostnames', () => {
+      const media = getMedia();
+      expect(media.getURLAudioMediaTeca('https://mediateca.educa.madrid.org.evil.com/audio/abc123')).toBe(false);
+      expect(media.getURLAudioMediaTeca('https://evil.com/?x=https://mediateca.educa.madrid.org/audio/abc123')).toBe(
+        false,
+      );
+      expect(media.getURLAudioMediaTeca('not a url')).toBe(false);
+    });
+
+    it('getURLAudioMediaTeca accepts legitimate audio and video URLs and preserves the id', () => {
+      const media = getMedia();
+      expect(media.getURLAudioMediaTeca('https://mediateca.educa.madrid.org/audio/abc123?x=1')).toBe(
+        'https://mediateca.educa.madrid.org/streaming.php?id=abc123',
+      );
+      expect(media.getURLAudioMediaTeca('https://mediateca.educa.madrid.org/video/xyz789?x=1')).toBe(
+        'https://mediateca.educa.madrid.org/streaming.php?id=xyz789',
+      );
+      expect(media.getURLAudioMediaTeca('https://mediateca.educa.madrid.org/other/abc123')).toBe(false);
+    });
+
     it('loadYoutubeApi is a function', () => {
       const media = getMedia();
       expect(typeof media.loadYoutubeApi).toBe('function');
diff --git a/public/app/common/mindmaps/src/index.html b/public/app/common/mindmaps/src/index.html
index 1c30d6aa6a..4420554268 100644
--- a/public/app/common/mindmaps/src/index.html
+++ b/public/app/common/mindmaps/src/index.html
@@ -233,7 +233,7 @@ <h2 class='image-description'>To download the map right-click the
 
   <script src="//ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js"></script>
   <script src="//api.filestackapi.com/filestack.js"></script>
-  <script src="//cdnjs.cloudflare.com/ajax/libs/FileSaver.js/1.3.3/FileSaver.min.js"></script>
+  <script src="https://cdnjs.cloudflare.com/ajax/libs/FileSaver.js/1.3.3/FileSaver.min.js" integrity="sha512-DvLlX4EDfBZuesenAya2TOiF+cR7GbRsV+IElolKTYIj8JJHr9BFTcznTuRFabG26vcVsmDCcv2dL7m8Ov1XfA==" crossorigin="anonymous"></script>
 
   <!-- DEBUG -->
   <!-- set debug flag for all scripts. Will be removed in production -->
diff --git a/public/app/core/EmbeddingBridge.js b/public/app/core/EmbeddingBridge.js
index 9fd84ba6dd..5c6840cb57 100644
--- a/public/app/core/EmbeddingBridge.js
+++ b/public/app/core/EmbeddingBridge.js
@@ -457,12 +457,9 @@ export default class EmbeddingBridge {
             try {
                 window.parent.postMessage(message, this.parentOrigin);
             } catch (e) {
-                // If origin validation fails, try with '*' for same-origin iframes
-                if (e.name === 'DataCloneError') {
-                    getLogger().error('[EmbeddingBridge] Cannot serialize message:', e);
-                } else {
-                    window.parent.postMessage(message, '*');
-                }
+                // Never broadcast to '*' on failure: it would leak the message to
+                // any origin. Log the error and drop the message instead.
+                getLogger().error('[EmbeddingBridge] Failed to post message to parent:', e);
             }
         }
     }
diff --git a/public/app/core/EmbeddingBridge.test.js b/public/app/core/EmbeddingBridge.test.js
index acf997adc1..0353e5b345 100644
--- a/public/app/core/EmbeddingBridge.test.js
+++ b/public/app/core/EmbeddingBridge.test.js
@@ -1036,24 +1036,32 @@ describe('EmbeddingBridge', () => {
             );
         });
 
-        it('should fallback to * on non-DataCloneError', () => {
+        it('should never broadcast to * when posting to parentOrigin throws', () => {
             bridge.parentOrigin = 'https://parent.com';
-            window.parent.postMessage = vi.fn()
-                .mockImplementationOnce(() => {
-                    throw new Error('Some other error');
-                })
-                .mockImplementationOnce(() => {});
+            const otherError = new Error('Some other error');
+            window.parent.postMessage = vi.fn(() => {
+                throw otherError;
+            });
 
             bridge.postToParent({ type: 'TEST' });
 
-            expect(window.parent.postMessage).toHaveBeenCalledTimes(2);
-            expect(window.parent.postMessage).toHaveBeenLastCalledWith(
+            // Only the single targeted attempt is made; no '*' fallback.
+            expect(window.parent.postMessage).toHaveBeenCalledTimes(1);
+            expect(window.parent.postMessage).toHaveBeenCalledWith(
                 { type: 'TEST' },
+                'https://parent.com'
+            );
+            expect(window.parent.postMessage).not.toHaveBeenCalledWith(
+                expect.anything(),
                 '*'
             );
+            expect(window.AppLogger.error).toHaveBeenCalledWith(
+                '[EmbeddingBridge] Failed to post message to parent:',
+                otherError
+            );
         });
 
-        it('should log error on DataCloneError', () => {
+        it('should log error on DataCloneError without broadcasting to *', () => {
             bridge.parentOrigin = 'https://parent.com';
             const dataCloneError = new Error('Cannot clone');
             dataCloneError.name = 'DataCloneError';
@@ -1063,8 +1071,13 @@ describe('EmbeddingBridge', () => {
 
             bridge.postToParent({ type: 'TEST' });
 
+            expect(window.parent.postMessage).toHaveBeenCalledTimes(1);
+            expect(window.parent.postMessage).not.toHaveBeenCalledWith(
+                expect.anything(),
+                '*'
+            );
             expect(window.AppLogger.error).toHaveBeenCalledWith(
-                '[EmbeddingBridge] Cannot serialize message:',
+                '[EmbeddingBridge] Failed to post message to parent:',
                 dataCloneError
             );
         });
diff --git a/public/app/locate/locale.js b/public/app/locate/locale.js
index a0cb0c547a..4faee44fc9 100644
--- a/public/app/locate/locale.js
+++ b/public/app/locate/locale.js
@@ -1,3 +1,18 @@
+/**
+ * Escape a string for use as a legacy escaped catalogue key.
+ *
+ * Backslashes are escaped FIRST and quotes second so the sanitization is
+ * complete: an input such as `\"` becomes `\\\"` instead of the ambiguous
+ * `\\"`. Inputs without backslashes (the common case, including every real
+ * translation source string) are unaffected, preserving existing lookups.
+ *
+ * @param {string} string
+ * @returns {string}
+ */
+function escapeCatalogueKey(string) {
+    return string.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
+}
+
 export default class Locale {
     constructor(app) {
         this.app = app;
@@ -67,7 +82,7 @@ export default class Locale {
         const catalogue = this.strings?.translations;
         if (catalogue) {
             // Try exact key first (server returns unescaped keys)
-            const key = string in catalogue ? string : string.replace(/"/g, '\\"');
+            const key = string in catalogue ? string : escapeCatalogueKey(string);
             if (key in catalogue) {
                 let res = catalogue[key].replace(/\\"/g, '"').replace(/\\\//g, '/');
                 if (res.startsWith('~')) res = res.substring(1);
@@ -84,7 +99,7 @@ export default class Locale {
         const catalogue = this.c_strings?.translations;
         if (catalogue) {
             // Try exact key first (server returns unescaped keys)
-            const key = string in catalogue ? string : string.replace(/"/g, '\\"');
+            const key = string in catalogue ? string : escapeCatalogueKey(string);
             if (key in catalogue) {
                 let res = catalogue[key].replace(/\\"/g, '"').replace(/\\\//g, '/');
                 if (res.startsWith('~')) res = res.substring(1);
@@ -152,7 +167,7 @@ export default class Locale {
      */
     getTranslation(string, lang, idevice) {
         if (typeof string != 'string') return '';
-        string = string ? string.replace(/"/g, '\\"') : '';
+        string = string ? escapeCatalogueKey(string) : '';
         lang = lang ? lang : this.lang;
         // Idevice po translation
         if (idevice) {
diff --git a/public/app/locate/locale.test.js b/public/app/locate/locale.test.js
index d4e3669c66..3485296986 100644
--- a/public/app/locate/locale.test.js
+++ b/public/app/locate/locale.test.js
@@ -235,4 +235,65 @@ describe('Locale translations', () => {
       expect(locale.getGUITranslation('text "quoted"')).toBe('text "quoted"');
     });
   });
+
+  describe('catalogue key escaping (incomplete-sanitization fix)', () => {
+    // Real XLF <source> keys are stored verbatim (unescaped). The first lookup
+    // branch handles those, so quoted source strings keep resolving exactly as
+    // before. These cases lock in that legitimate-input behaviour.
+    it('getGUITranslation still resolves a real quoted source key', () => {
+      locale.strings = { translations: { 'Click the "Reply" button.': '~Pulsa el botón "Responder".' } };
+      expect(locale.getGUITranslation('Click the "Reply" button.')).toBe('Pulsa el botón "Responder".');
+    });
+
+    it('getContentTranslation still resolves a real quoted source key', () => {
+      locale.c_strings = { translations: { 'Open "{name}".': 'Abrir "{name}".' } };
+      expect(locale.getContentTranslation('Open "{name}".')).toBe('Abrir "{name}".');
+    });
+
+    // Security property (incomplete-sanitization): backslashes in the input
+    // must be escaped BEFORE quotes, so a literal backslash in the lookup key
+    // is doubled. The naive `replace(/"/g, '\\"')` left backslashes untouched,
+    // letting `\"` collapse ambiguously. Inputs WITHOUT backslashes (every real
+    // translation source string) escape identically, preserving lookups.
+
+    it('getGUITranslation doubles backslashes when building the fallback key', () => {
+      // Plain quote (no backslash) must still escape to `\"` and resolve the
+      // legacy escaped key exactly as before — behaviour preserved.
+      // Key `\\"` in JS source = backslash + quote.
+      locale.strings = { translations: { '\\"': 'plain-quote-value' } };
+      expect(locale.getGUITranslation('"')).toBe('plain-quote-value');
+
+      // Backslash-bearing input `\y` is NOT a direct key, so it goes through the
+      // escaping fallback. Backslash-first escaping builds key `\\y` (doubled
+      // backslash + y). The catalogue exposes only that correctly-escaped key
+      // plus the naive single-backslash form; the fix must resolve the former.
+      locale.strings = {
+        translations: { '\\\\y': 'correct', z: 'unused' },
+      };
+      expect(locale.getGUITranslation('\\y')).toBe('correct');
+    });
+
+    it('getContentTranslation doubles backslashes when building the fallback key', () => {
+      locale.c_strings = { translations: { '\\"': 'plain-quote-value' } };
+      expect(locale.getContentTranslation('"')).toBe('plain-quote-value');
+
+      locale.c_strings = {
+        translations: { '\\\\y': 'correct', z: 'unused' },
+      };
+      expect(locale.getContentTranslation('\\y')).toBe('correct');
+    });
+
+    it('getTranslation doubles backslashes when building the lookup key', () => {
+      // Plain quote still escapes to `\"` and resolves the legacy escaped key.
+      locale.strings = { translations: { '\\"': 'plain-quote-value' } };
+      expect(locale.getTranslation('"')).toBe('plain-quote-value');
+
+      // getTranslation escapes the input unconditionally; with backslash-first
+      // escaping `\y` becomes `\\y` (doubled), matching the correctly-escaped key.
+      locale.strings = {
+        translations: { '\\\\y': 'correct', z: 'unused' },
+      };
+      expect(locale.getTranslation('\\y')).toBe('correct');
+    });
+  });
 });
diff --git a/public/app/workarea/interface/elements/previewPanel.js b/public/app/workarea/interface/elements/previewPanel.js
index 2214ce8a4a..30889795f5 100644
--- a/public/app/workarea/interface/elements/previewPanel.js
+++ b/public/app/workarea/interface/elements/previewPanel.js
@@ -1156,7 +1156,7 @@ export default class PreviewPanelManager {
 
         // Inline JS: <script src="path"> </script> (note: space inside tag is common)
         html = html.replace(
-            /<script\s+[^>]*src=["']([^"']+)["'][^>]*>[^<]*<\/script>/gi,
+            /<script\s+[^>]*src=["']([^"']+)["'][^>]*>[^<]*<\/script\s*>/gi,
             (match, src) => {
                 const content = this._decodeFileContent(this._findFileContent(files, src));
                 if (content) {
diff --git a/public/app/workarea/interface/elements/previewPanel.test.js b/public/app/workarea/interface/elements/previewPanel.test.js
index c10b3dc287..6fac234ed0 100644
--- a/public/app/workarea/interface/elements/previewPanel.test.js
+++ b/public/app/workarea/interface/elements/previewPanel.test.js
@@ -1593,6 +1593,28 @@ describe('PreviewPanelManager', () => {
       expect(result).not.toContain('src="app.js"');
     });
 
+    it('should inline JS script tags with whitespace before the closing angle bracket', () => {
+      const html = '<html><body><script src="app.js"></script ></body></html>';
+      const files = { 'app.js': 'console.log("hello")' };
+
+      const result = manager._inlineResources(html, files);
+
+      expect(result).toContain('<script>');
+      expect(result).toContain('console.log("hello")');
+      expect(result).not.toContain('src="app.js"');
+    });
+
+    it('should inline JS script tags with newline and mixed-case closing tag', () => {
+      const html = '<html><body><script src="app.js"></SCRIPT\n></body></html>';
+      const files = { 'app.js': 'console.log("hi")' };
+
+      const result = manager._inlineResources(html, files);
+
+      expect(result).toContain('<script>');
+      expect(result).toContain('console.log("hi")');
+      expect(result).not.toContain('src="app.js"');
+    });
+
     it('should leave tags unchanged when file not found', () => {
       const html = '<html><head><link rel="stylesheet" href="missing.css"></head></html>';
       const files = {};
diff --git a/public/app/yjs/AssetManager.js b/public/app/yjs/AssetManager.js
index ad22826bce..3221375da7 100644
--- a/public/app/yjs/AssetManager.js
+++ b/public/app/yjs/AssetManager.js
@@ -1975,9 +1975,12 @@ class AssetManager {
    * @private
    */
   _generateLinkHandlerScript(assetId, baseFolder) {
-    // Escape special characters for safe embedding in script
-    const escapedAssetId = assetId.replace(/'/g, "\\'");
-    const escapedBaseFolder = baseFolder.replace(/'/g, "\\'");
+    // Escape special characters for safe embedding in a single-quoted JS string.
+    // Backslashes MUST be escaped first so a trailing/embedded backslash cannot
+    // consume the quote-escaping backslash and break out of the string literal.
+    const escapeForSingleQuotedString = value => String(value).replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+    const escapedAssetId = escapeForSingleQuotedString(assetId);
+    const escapedBaseFolder = escapeForSingleQuotedString(baseFolder);
 
     return `
 <script>
diff --git a/public/app/yjs/AssetManager.test.js b/public/app/yjs/AssetManager.test.js
index 4fd62456ec..02eb628702 100644
--- a/public/app/yjs/AssetManager.test.js
+++ b/public/app/yjs/AssetManager.test.js
@@ -7407,6 +7407,26 @@ describe('_generateLinkHandlerScript', () => {
     expect(script).toContain("folder\\'s/path");
   });
 
+  it('escapes backslashes before quotes so a trailing backslash cannot break out of the string literal', () => {
+    // A naive `replace(/'/g, "\\'")` that does not escape backslashes first lets an
+    // input ending in a backslash consume the escaping backslash: `\` + `\'` -> `\\'`
+    // which closes the JS string literal and enables injection. Escaping backslashes
+    // first turns the lone backslash into a literal `\\`, keeping the value inert.
+    const script = assetManager._generateLinkHandlerScript("asset\\'; alert(1);//", 'safe/folder');
+
+    // The backslash must be doubled (escaped) and the quote still escaped.
+    expect(script).toContain("assetId: 'asset\\\\\\'; alert(1);//'");
+    // The raw breakout sequence (closing quote followed by live JS) must NOT appear.
+    expect(script).not.toContain("asset\\'; alert(1);//',");
+  });
+
+  it('escapes a lone trailing backslash in baseFolder', () => {
+    const script = assetManager._generateLinkHandlerScript('asset-123', 'folder\\');
+
+    // Single backslash becomes a doubled (escaped) backslash inside the literal.
+    expect(script).toContain("baseFolder: 'folder\\\\'");
+  });
+
   it('handles empty baseFolder', () => {
     const script = assetManager._generateLinkHandlerScript('asset-123', '');
 
diff --git a/public/app/yjs/ResourceFetcher.js b/public/app/yjs/ResourceFetcher.js
index 8fd4382c81..41f620d5ea 100644
--- a/public/app/yjs/ResourceFetcher.js
+++ b/public/app/yjs/ResourceFetcher.js
@@ -367,6 +367,25 @@ class ResourceFetcher {
     return files;
   }
 
+  /**
+   * Validate that a bundle URL is safe to fetch.
+   * Accepts same-origin/relative paths, protocol-relative URLs (which inherit
+   * the page's protocol — https on any served page), and explicit https:// URLs.
+   * Rejects plain http:// and any other scheme (data:, file:, javascript:, etc.)
+   * so executable resources are never downloaded over an insecure channel.
+   * @param {string} bundleUrl
+   * @returns {boolean}
+   */
+  static isSafeBundleUrl(bundleUrl) {
+    if (typeof bundleUrl !== 'string' || bundleUrl.length === 0) return false;
+    // Protocol-relative URLs (//host/path) inherit the document protocol.
+    if (bundleUrl.startsWith('//')) return true;
+    // Any URL that does not start with a scheme is a relative/same-origin path.
+    if (!/^[a-z][a-z0-9+.-]*:/i.test(bundleUrl)) return true;
+    // Absolute URL with an explicit scheme: only https is allowed.
+    return /^https:/i.test(bundleUrl);
+  }
+
   /**
    * Fetch ZIP bundle from server
    * @param {string} bundleUrl - URL to the ZIP bundle
@@ -374,6 +393,14 @@ class ResourceFetcher {
    */
   async fetchBundle(bundleUrl) {
     try {
+      // Security: only fetch bundles over a safe transport. Relative/same-origin
+      // URLs and explicit https:// (or protocol-relative // that inherits the
+      // page protocol) are allowed; plain http:// and other schemes are rejected
+      // to avoid downloading executable resources over an insecure channel.
+      if (!ResourceFetcher.isSafeBundleUrl(bundleUrl)) {
+        console.warn(`[ResourceFetcher] Refusing to fetch bundle over insecure URL: ${bundleUrl}`);
+        return null;
+      }
       Logger.log(`[ResourceFetcher] Fetching bundle: ${bundleUrl}`);
       const response = await fetch(bundleUrl);
 
diff --git a/public/app/yjs/ResourceFetcher.test.js b/public/app/yjs/ResourceFetcher.test.js
index 5aa515caf8..d7314a9075 100644
--- a/public/app/yjs/ResourceFetcher.test.js
+++ b/public/app/yjs/ResourceFetcher.test.js
@@ -1386,7 +1386,7 @@ describe('ResourceFetcher', () => {
         arrayBuffer: () => Promise.resolve(new ArrayBuffer(10)),
       });
 
-      const result = await fetcher.fetchBundle('http://example.com/bundle.zip');
+      const result = await fetcher.fetchBundle('https://example.com/bundle.zip');
 
       expect(result).toBeInstanceOf(Map);
       expect(result.size).toBe(1);
@@ -1398,7 +1398,7 @@ describe('ResourceFetcher', () => {
       const fetcher = new ResourceFetcher();
       mockFetch.mockResolvedValueOnce({ ok: false, status: 404 });
 
-      const result = await fetcher.fetchBundle('http://example.com/missing.zip');
+      const result = await fetcher.fetchBundle('https://example.com/missing.zip');
 
       expect(result).toBeNull();
     });
@@ -1407,9 +1407,77 @@ describe('ResourceFetcher', () => {
       const fetcher = new ResourceFetcher();
       mockFetch.mockRejectedValueOnce(new Error('Network error'));
 
-      const result = await fetcher.fetchBundle('http://example.com/error.zip');
+      const result = await fetcher.fetchBundle('https://example.com/error.zip');
+
+      expect(result).toBeNull();
+    });
+
+    it('refuses to fetch a bundle over insecure http:// and does not call fetch', async () => {
+      const fetcher = new ResourceFetcher();
+
+      const result = await fetcher.fetchBundle('http://example.com/bundle.zip');
 
       expect(result).toBeNull();
+      expect(mockFetch).not.toHaveBeenCalled();
+    });
+
+    it('refuses non-https schemes (data:, javascript:, file:) without fetching', async () => {
+      const fetcher = new ResourceFetcher();
+
+      for (const url of [
+        'data:application/zip;base64,UEsDBA==',
+        'javascript:alert(1)',
+        'file:///etc/passwd',
+        'ftp://example.com/bundle.zip',
+      ]) {
+        // eslint-disable-next-line no-await-in-loop
+        const result = await fetcher.fetchBundle(url);
+        expect(result).toBeNull();
+      }
+
+      expect(mockFetch).not.toHaveBeenCalled();
+    });
+
+    it('allows relative/same-origin bundle URLs', async () => {
+      const fetcher = new ResourceFetcher();
+      window.fflate = {
+        unzipSync: vi.fn().mockReturnValue({
+          'file.txt': new Uint8Array([116, 101, 115, 116]),
+        }),
+      };
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        headers: { get: () => '100' },
+        arrayBuffer: () => Promise.resolve(new ArrayBuffer(10)),
+      });
+
+      const result = await fetcher.fetchBundle('/web/exelearning/bundles/libs.zip');
+
+      expect(mockFetch).toHaveBeenCalledWith('/web/exelearning/bundles/libs.zip');
+      expect(result).toBeInstanceOf(Map);
+      expect(result.size).toBe(1);
+
+      delete window.fflate;
+    });
+  });
+
+  describe('isSafeBundleUrl', () => {
+    it('accepts relative, protocol-relative and https URLs', () => {
+      expect(ResourceFetcher.isSafeBundleUrl('/bundles/libs.zip')).toBe(true);
+      expect(ResourceFetcher.isSafeBundleUrl('bundles/libs.zip')).toBe(true);
+      expect(ResourceFetcher.isSafeBundleUrl('//cdn.example.com/x.zip')).toBe(true);
+      expect(ResourceFetcher.isSafeBundleUrl('https://example.com/x.zip')).toBe(true);
+      expect(ResourceFetcher.isSafeBundleUrl('HTTPS://EXAMPLE.com/x.zip')).toBe(true);
+    });
+
+    it('rejects insecure or non-http schemes and invalid input', () => {
+      expect(ResourceFetcher.isSafeBundleUrl('http://example.com/x.zip')).toBe(false);
+      expect(ResourceFetcher.isSafeBundleUrl('ftp://example.com/x.zip')).toBe(false);
+      expect(ResourceFetcher.isSafeBundleUrl('data:text/plain,x')).toBe(false);
+      expect(ResourceFetcher.isSafeBundleUrl('javascript:alert(1)')).toBe(false);
+      expect(ResourceFetcher.isSafeBundleUrl('')).toBe(false);
+      expect(ResourceFetcher.isSafeBundleUrl(null)).toBe(false);
+      expect(ResourceFetcher.isSafeBundleUrl(undefined)).toBe(false);
     });
   });
 
diff --git a/public/app/yjs/YjsProjectBridge.js b/public/app/yjs/YjsProjectBridge.js
index 7721f90e70..54d95d9163 100644
--- a/public/app/yjs/YjsProjectBridge.js
+++ b/public/app/yjs/YjsProjectBridge.js
@@ -11,6 +11,31 @@
  *   // Now all save operations go through Yjs
  *   bridge.enableAutoSync();
  */
+
+/**
+ * Strip every <script>...</script> tag from an HTML string.
+ *
+ * The end-tag pattern tolerates optional whitespace before the closing angle
+ * bracket (e.g. `</script >`) and is case-insensitive, so real-world end tags
+ * are not missed (bad-tag-filter). The replacement is applied repeatedly until
+ * the string stops changing, so a nested/obfuscated payload such as
+ * `<scr<script>ipt>` cannot splice two halves into a fresh `<script>` that
+ * survives a single pass (incomplete-multi-character-sanitization).
+ *
+ * @param {string} htmlString - HTML markup to sanitize
+ * @returns {string} HTML with all <script> tags removed
+ */
+function stripScriptTags(htmlString) {
+  const scriptTagRe = /<script\b[^<]*(?:(?!<\/script\s*>)<[^<]*)*<\/script\s*>/gi;
+  let result = htmlString;
+  let previous;
+  do {
+    previous = result;
+    result = result.replace(scriptTagRe, '');
+  } while (result !== previous);
+  return result;
+}
+
 class YjsProjectBridge {
   /**
    * @param {Object} app - The eXeLearning app instance
@@ -3072,7 +3097,7 @@ class YjsProjectBridge {
 
       // Remove all <script> tags — JS is not needed for a static screenshot
       // and would cause 404 errors since paths are relative to the main page
-      htmlString = htmlString.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
+      htmlString = stripScriptTags(htmlString);
 
       // Capture screenshot using html2canvas in a hidden iframe
       const dataUrl = await this._captureHtmlAsScreenshot(htmlString);
@@ -4298,6 +4323,7 @@ class YjsProjectBridge {
 // Export for use
 if (typeof module !== 'undefined' && module.exports) {
   module.exports = YjsProjectBridge;
+  module.exports.stripScriptTags = stripScriptTags;
 } else {
   window.YjsProjectBridge = YjsProjectBridge;
 }
diff --git a/public/app/yjs/YjsProjectBridge.test.js b/public/app/yjs/YjsProjectBridge.test.js
index 2d71f7eef0..ed4d281b93 100644
--- a/public/app/yjs/YjsProjectBridge.test.js
+++ b/public/app/yjs/YjsProjectBridge.test.js
@@ -7456,3 +7456,41 @@ describe('YjsProjectBridge', () => {
     });
   });
 });
+
+describe('stripScriptTags', () => {
+  const stripScriptTags = YjsProjectBridge.stripScriptTags;
+
+  it('removes a simple <script> tag', () => {
+    const out = stripScriptTags('<p>hi</p><script>alert(1)</script><p>bye</p>');
+    expect(out).toBe('<p>hi</p><p>bye</p>');
+    expect(out.toLowerCase()).not.toContain('<script');
+  });
+
+  it('removes end tags with whitespace before the angle bracket (bad-tag-filter)', () => {
+    const out = stripScriptTags('<script>evil()</script >after');
+    expect(out).toBe('after');
+    expect(out.toLowerCase()).not.toContain('<script');
+  });
+
+  it('removes scripts across newlines and mixed casing (bad-tag-filter)', () => {
+    const out = stripScriptTags('before<SCRIPT type="text/javascript">\n  evil();\n</Script\n>after');
+    expect(out).toBe('beforeafter');
+    expect(out.toLowerCase()).not.toContain('<script');
+  });
+
+  it('strips a nested/obfuscated payload to a fixed point (multi-character-sanitization)', () => {
+    const out = stripScriptTags('<scr<script>ipt>alert(1)</script>done');
+    expect(out.toLowerCase()).not.toContain('<script');
+    expect(out).toContain('done');
+  });
+
+  it('preserves legitimate markup that is not a script tag', () => {
+    const html = '<div class="x"><p>keep <b>me</b></p><img src="a.png" /></div>';
+    expect(stripScriptTags(html)).toBe(html);
+  });
+
+  it('does not strip text that merely mentions script without a real tag', () => {
+    const html = '<p>The word script is fine here</p>';
+    expect(stripScriptTags(html)).toBe(html);
+  });
+});
diff --git a/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.js b/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.js
index 90124ad4ae..4855ba86cd 100644
--- a/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.js
+++ b/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.js
@@ -158,10 +158,15 @@ var $exeDevice = {
 
     normalizeQuestionsPerRound: value => Math.max(parseInt(value, 10) || 1, 1),
 
-    removeTags: str =>
-        String(str ?? '')
-            .replace(/<[^>]*>/g, '')
-            .trim(),
+    removeTags: str => {
+        let result = String(str ?? '');
+        let prev;
+        do {
+            prev = result;
+            result = result.replace(/<[^>]*>/g, '');
+        } while (result !== prev);
+        return result.trim();
+    },
 
     /**
      * Reusable audio input with voice recorder, matching quick-questions'
diff --git a/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.test.js b/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.test.js
index 5ee6a7b9ab..b63341f97d 100644
--- a/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.test.js
+++ b/public/files/perm/idevices/base/adaptative-quiz/edition/adaptative-quiz.test.js
@@ -1936,4 +1936,33 @@ describe('adaptative-quiz edition', () => {
             expect(validateCalls).toBe(0);
         });
     });
+
+    describe('removeTags', () => {
+        it('strips a simple tag and trims the remaining text', () => {
+            expect(idevice.removeTags('<p>  Hello  </p>')).toBe('Hello');
+        });
+
+        it('returns an empty string for nullish input', () => {
+            expect(idevice.removeTags(null)).toBe('');
+            expect(idevice.removeTags(undefined)).toBe('');
+        });
+
+        it('leaves no live <script tag behind for nested/obfuscated payloads', () => {
+            // Security property: regardless of how the tags are nested or split,
+            // the fixed-point sanitizer must not leave a usable `<script` token.
+            const payloads = [
+                '<scr<script>ipt>alert(1)</script>',
+                '<<script>script>alert(1)<</script>/script>',
+                '<scr<i>ipt>alert(1)',
+            ];
+            for (const payload of payloads) {
+                expect(idevice.removeTags(payload).toLowerCase()).not.toContain('<script');
+            }
+        });
+
+        it('preserves tag-free text content unchanged', () => {
+            expect(idevice.removeTags('  Plain question text  ')).toBe('Plain question text');
+            expect(idevice.removeTags('2 plus 3 equals 5')).toBe('2 plus 3 equals 5');
+        });
+    });
 });
diff --git a/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.js b/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.js
index e926b0e4ed..be5feeaacf 100644
--- a/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.js
+++ b/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.js
@@ -1212,11 +1212,16 @@ var $exeDevice = {
 
         const words = [];
         $entries.find('ENTRY').each(function () {
-            const concept = $(this).find('CONCEPT').text(),
-                definition = $(this)
-                    .find('DEFINITION')
-                    .text()
-                    .replace(/<[^>]*>/g, '');
+            const concept = $(this).find('CONCEPT').text();
+            let definition = $(this).find('DEFINITION').text();
+            // Strip HTML tags repeatedly: removing one tag can splice
+            // surrounding characters into a new tag (e.g. "<<a>script>"),
+            // so loop until the string stops changing.
+            let prevDefinition;
+            do {
+                prevDefinition = definition;
+                definition = definition.replace(/<[^>]*>/g, '');
+            } while (definition !== prevDefinition);
             if (concept && definition) {
                 words.push(`${concept}#${definition}`);
             }
diff --git a/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.test.js b/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.test.js
index f0294d99ba..f1549c393e 100644
--- a/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.test.js
+++ b/public/files/perm/idevices/base/az-quiz-game/edition/az-quiz-game.test.js
@@ -32,7 +32,13 @@ function loadIdevice(code) {
   // Helper to strip HTML tags
   const stripTags = (html) => {
     if (!html) return '';
-    return String(html).replace(/<[^>]*>/g, '');
+    let result = String(html);
+    let prev;
+    do {
+      prev = result;
+      result = result.replace(/<[^>]*>/g, '');
+    } while (result !== prev);
+    return result;
   };
 
   // Mock jQuery with chaining support
@@ -525,4 +531,57 @@ describe('az-quiz-game iDevice', () => {
       expect(typeof $exeDevice.validateData).toBe('function');
     });
   });
+
+  describe('mock $ text() stripTags helper', () => {
+    it('strips a simple HTML tag from selector text', () => {
+      expect(global.$('<p>Hello</p>').text()).toBe('Hello');
+    });
+
+    it('strips nested/obfuscated tags, leaving no complete tag behind', () => {
+      // The fixed-point loop keeps stripping until the string stops
+      // changing, so a nested/obfuscated payload cannot leave a complete
+      // `<...>` tag (in particular, no `<script>`) behind.
+      const payload = '<scr<script>ipt>alert(1)</script>';
+      const result = global.$(payload).text();
+      // No surviving complete HTML tag, and no `<script` token.
+      expect(result.toLowerCase()).not.toContain('<script>');
+      expect(result).not.toMatch(/<[^>]*>/);
+    });
+
+    it('leaves plain text without tags unchanged', () => {
+      expect(global.$('Plain text').text()).toBe('Plain text');
+    });
+  });
+
+  describe('importGlosary definition sanitization', () => {
+    // importGlosary strips HTML tags from each DEFINITION using a
+    // fixed-point loop so that removing one tag cannot splice surrounding
+    // characters into a new tag. This mirrors the source logic and asserts
+    // the security property on an obfuscated payload while preserving
+    // legitimate text.
+    const stripDefinition = (text) => {
+      let definition = text;
+      let prevDefinition;
+      do {
+        prevDefinition = definition;
+        definition = definition.replace(/<[^>]*>/g, '');
+      } while (definition !== prevDefinition);
+      return definition;
+    };
+
+    it('leaves no complete tag behind for an obfuscated payload', () => {
+      const payload = '<scr<script>ipt>The Sun</script>';
+      const result = stripDefinition(payload);
+      expect(result.toLowerCase()).not.toContain('<script>');
+      expect(result).not.toMatch(/<[^>]*>/);
+    });
+
+    it('removes simple tags while keeping legitimate definition text', () => {
+      expect(stripDefinition('<p>A star</p>')).toBe('A star');
+    });
+
+    it('leaves plain definition text unchanged', () => {
+      expect(stripDefinition('A celestial body')).toBe('A celestial body');
+    });
+  });
 });
diff --git a/public/files/perm/idevices/base/crossword/edition/crossword.js b/public/files/perm/idevices/base/crossword/edition/crossword.js
index 388840a97a..bb4a2e70ef 100644
--- a/public/files/perm/idevices/base/crossword/edition/crossword.js
+++ b/public/files/perm/idevices/base/crossword/edition/crossword.js
@@ -551,6 +551,19 @@ var $exeDevice = {
             .replace(/'/g, '&#39;');
     },
 
+    stripTags: function (string) {
+        let result = String(string),
+            prev;
+        // Apply the strip repeatedly until it reaches a fixed point so that
+        // removing one tag cannot splice two halves into a new tag (e.g.
+        // "<<div>div>" -> "<div>"). See incomplete-multi-character-sanitization.
+        do {
+            prev = result;
+            result = result.replace(/<[^>]*>/g, '');
+        } while (result !== prev);
+        return result;
+    },
+
     save: function () {
         if (!$exeDevice.validateQuestion()) return;
 
@@ -1522,10 +1535,9 @@ var $exeDevice = {
         const words = [];
         $entries.find('ENTRY').each(function () {
             const concept = $(this).find('CONCEPT').text(),
-                definition = $(this)
-                    .find('DEFINITION')
-                    .text()
-                    .replace(/<[^>]*>/g, '');
+                definition = $exeDevice.stripTags(
+                    $(this).find('DEFINITION').text()
+                );
             if (concept && definition) {
                 let wd = {
                     word: concept,
diff --git a/public/files/perm/idevices/base/crossword/edition/crossword.test.js b/public/files/perm/idevices/base/crossword/edition/crossword.test.js
index 4568aec405..44e4c7a25a 100644
--- a/public/files/perm/idevices/base/crossword/edition/crossword.test.js
+++ b/public/files/perm/idevices/base/crossword/edition/crossword.test.js
@@ -125,6 +125,35 @@ describe('crossword iDevice', () => {
     });
   });
 
+  describe('stripTags', () => {
+    it('removes simple HTML tags', () => {
+      expect($exeDevice.stripTags('<b>hello</b>')).toBe('hello');
+      expect($exeDevice.stripTags('a <span class="x">word</span> here')).toBe('a word here');
+    });
+
+    it('leaves plain text untouched', () => {
+      expect($exeDevice.stripTags('Plain definition text')).toBe('Plain definition text');
+      expect($exeDevice.stripTags('')).toBe('');
+    });
+
+    it('strips obfuscated/nested tags so no tag can survive', () => {
+      const payload = '<scr<script>ipt>alert(1)</script>';
+      const cleaned = $exeDevice.stripTags(payload);
+      // The dangerous "<script" opener must not survive reassembly.
+      expect(cleaned.toLowerCase()).not.toContain('<script');
+      // No residual tag (anything matching <...>) is left behind.
+      expect(cleaned).not.toMatch(/<[^>]*>/);
+    });
+
+    it('reaches a fixed point: re-stripping the output is a no-op', () => {
+      const payload = '<<div>script<script>>alert(1)</script>';
+      const once = $exeDevice.stripTags(payload);
+      // A single-pass strip can splice new tags; the loop must converge.
+      expect(once).not.toMatch(/<[^>]*>/);
+      expect(once.replace(/<[^>]*>/g, '')).toBe(once);
+    });
+  });
+
   describe('validTime', () => {
     it('returns true for valid time format hh:mm:ss', () => {
       expect($exeDevice.validTime('00:00:00')).toBe(true);
diff --git a/public/files/perm/idevices/base/discover/edition/discover.js b/public/files/perm/idevices/base/discover/edition/discover.js
index 6b9fc173fa..fc6fcc7caf 100644
--- a/public/files/perm/idevices/base/discover/edition/discover.js
+++ b/public/files/perm/idevices/base/discover/edition/discover.js
@@ -1723,11 +1723,15 @@ var $exeDevice = {
         const cardsJson = $entries
             .find('ENTRY')
             .map((_, entry) => {
-                const concept = $(entry).find('CONCEPT').text(),
-                    definition = $(entry)
-                        .find('DEFINITION')
-                        .text()
-                        .replace(/<[^>]*>/g, '');
+                const concept = $(entry).find('CONCEPT').text();
+                let definition = $(entry).find('DEFINITION').text(),
+                    prevDefinition;
+                // Re-apply the tag strip until the result stabilises so that
+                // overlapping/nested markup cannot splice into a new tag.
+                do {
+                    prevDefinition = definition;
+                    definition = definition.replace(/<[^>]*>/g, '');
+                } while (definition !== prevDefinition);
                 return concept && definition
                     ? { eText: concept, eTextBk: definition }
                     : null;
diff --git a/public/files/perm/idevices/base/discover/edition/discover.test.js b/public/files/perm/idevices/base/discover/edition/discover.test.js
index f790642bf6..28d5de4b35 100644
--- a/public/files/perm/idevices/base/discover/edition/discover.test.js
+++ b/public/files/perm/idevices/base/discover/edition/discover.test.js
@@ -82,9 +82,15 @@ const $exeDevice = {
     removeTags: function (str) {
         const wrapper = { 
             html: function(content) { this.content = content; },
-            text: function() { 
+            text: function() {
                 if (!this.content) return '';
-                return this.content.replace(/<[^>]*>/g, '');
+                let result = this.content;
+                let prev;
+                do {
+                    prev = result;
+                    result = result.replace(/<[^>]*>/g, '');
+                } while (result !== prev);
+                return result;
             }
         };
         wrapper.html(str);
@@ -294,6 +300,21 @@ describe('Discover Edition Functions', () => {
             expect($exeDevice.removeTags('<div class="test" id="myDiv">Content</div>')).toBe('Content');
             expect($exeDevice.removeTags('<a href="http://example.com" target="_blank">Link</a>')).toBe('Link');
         });
+
+        it('should leave no <script residue for nested/obfuscated payloads', () => {
+            const result = $exeDevice.removeTags('<scr<script>ipt>alert(1)</script>');
+            expect(result.toLowerCase()).not.toContain('<script');
+            expect(result).not.toContain('<');
+        });
+
+        it('should strip tags repeatedly to a fixed point (idempotent)', () => {
+            // Re-sanitizing the output must not change it further, and no
+            // residual tag-opening "<" may survive a spliced payload.
+            const once = $exeDevice.removeTags('<a<b>>c<d>e');
+            const twice = $exeDevice.removeTags(once);
+            expect(twice).toBe(once);
+            expect(once).not.toContain('<');
+        });
     });
 
     describe('escapeQuotes', () => {
@@ -494,6 +515,67 @@ describe('Discover Edition Functions', () => {
         });
     });
 
+    describe('importGlosary sanitization', () => {
+        // importGlosary parses real XML and uses jQuery DOM traversal, so it
+        // needs the genuine jQuery/DOMParser. The file-level mock above replaces
+        // global.$ (and, since window === globalThis here, window.$) with a
+        // vi.fn stub, but the real jQuery is still reachable via global.jQuery
+        // and the real DOMParser via global.DOMParser (both set by the setup).
+        const xmlEscape = (s) =>
+            s
+                .replace(/&/g, '&amp;')
+                .replace(/</g, '&lt;')
+                .replace(/>/g, '&gt;');
+        // The payload is XML-escaped so that .text() yields it back as literal
+        // characters that reach the regex strip (otherwise the XML parser would
+        // treat it as markup and discard the tags itself).
+        const buildGlosaryXml = (definitionInner) =>
+            `<GLOSSARY><ENTRIES><ENTRY><CONCEPT>Term</CONCEPT>` +
+            `<DEFINITION>${xmlEscape(definitionInner)}</DEFINITION></ENTRY></ENTRIES></GLOSSARY>`;
+
+        const importWithRealJQuery = (xml) => {
+            const savedDollar = global.$;
+            global.$ = global.jQuery;
+            try {
+                const realExeDevice = global.loadIdevice(
+                    join(__dirname, 'discover.js')
+                );
+                let captured = null;
+                realExeDevice.insertCards = (cards) => {
+                    captured = cards;
+                };
+                realExeDevice.importGlosary(xml);
+                return captured;
+            } finally {
+                global.$ = savedDollar;
+            }
+        };
+
+        it('strips legitimate inline markup from definitions', () => {
+            const cards = importWithRealJQuery(
+                buildGlosaryXml('A <b>bold</b> definition')
+            );
+            expect(cards).toEqual([
+                { eText: 'Term', eTextBk: 'A bold definition' },
+            ]);
+        });
+
+        it('fully removes nested/obfuscated tag payloads (no <script left behind)', () => {
+            // Nested/overlapping tag fragments must not survive the strip.
+            // The fixed-point loop in importGlosary re-applies the same regex
+            // until the string stabilises, so no residual "<...>" or "<script"
+            // can leak through and the surrounding text is preserved.
+            const cards = importWithRealJQuery(
+                buildGlosaryXml('<scr<script>ipt>alert(1)</script>safe')
+            );
+            expect(cards).toHaveLength(1);
+            const definition = cards[0].eTextBk;
+            expect(definition.toLowerCase()).not.toContain('<script');
+            expect(definition).not.toContain('<');
+            expect(definition).toContain('safe');
+        });
+    });
+
     describe('real exportQuestions regression', () => {
         it('downloads question text with the discover filename and container', () => {
             const realExeDevice = global.loadIdevice(join(__dirname, 'discover.js'));
diff --git a/public/files/perm/idevices/base/dragdrop/edition/dragdrop.js b/public/files/perm/idevices/base/dragdrop/edition/dragdrop.js
index 623867b3df..5b187f16d6 100644
--- a/public/files/perm/idevices/base/dragdrop/edition/dragdrop.js
+++ b/public/files/perm/idevices/base/dragdrop/edition/dragdrop.js
@@ -460,11 +460,11 @@ var $exeDevice = {
     },
 
     decodeURIComponentSafe: function (s) {
-        return s ? decodeURIComponent(s).replace('&percnt;', '%') : s;
+        return s ? decodeURIComponent(s).replace(/&percnt;/g, '%') : s;
     },
 
     encodeURIComponentSafe: function (s) {
-        return s ? encodeURIComponent(s.replace('%', '&percnt;')) : s;
+        return s ? encodeURIComponent(s.replace(/%/g, '&percnt;')) : s;
     },
 
     validateCard: function () {
diff --git a/public/files/perm/idevices/base/dragdrop/edition/dragdrop.test.js b/public/files/perm/idevices/base/dragdrop/edition/dragdrop.test.js
index e44adfd5d4..c97bdd156b 100644
--- a/public/files/perm/idevices/base/dragdrop/edition/dragdrop.test.js
+++ b/public/files/perm/idevices/base/dragdrop/edition/dragdrop.test.js
@@ -41,4 +41,33 @@ describe('dragdrop iDevice export helpers', () => {
         expect(downloadBlob.mock.calls[0][1]).toBe('Activity-DragDrop.json');
         expect(downloadBlob.mock.calls[0][2]).toBe('dragdropQIdeviceForm');
     });
+
+    it('escapes every percent sign when encoding, not just the first', () => {
+        // Multiple '%' must all be escaped (global flag), otherwise the
+        // unescaped ones become decoder control characters.
+        const encoded = $exeDevice.encodeURIComponentSafe('100% off 50% sale');
+        expect(encoded).not.toContain('%25');
+        expect(encoded).toBe(encodeURIComponent('100&percnt; off 50&percnt; sale'));
+    });
+
+    it('round-trips strings containing multiple percent signs', () => {
+        const original = 'a%b%c%d';
+        const restored = $exeDevice.decodeURIComponentSafe(
+            $exeDevice.encodeURIComponentSafe(original)
+        );
+        expect(restored).toBe(original);
+    });
+
+    it('preserves legitimate input without percent signs', () => {
+        const original = 'https://example.com/image (1).png';
+        const restored = $exeDevice.decodeURIComponentSafe(
+            $exeDevice.encodeURIComponentSafe(original)
+        );
+        expect(restored).toBe(original);
+    });
+
+    it('returns falsy input unchanged for both safe helpers', () => {
+        expect($exeDevice.encodeURIComponentSafe('')).toBe('');
+        expect($exeDevice.decodeURIComponentSafe('')).toBe('');
+    });
 });
diff --git a/public/files/perm/idevices/base/electrical-circuits/edition/electrical-circuits.js b/public/files/perm/idevices/base/electrical-circuits/edition/electrical-circuits.js
index da405c0680..ae9fabc0fc 100644
--- a/public/files/perm/idevices/base/electrical-circuits/edition/electrical-circuits.js
+++ b/public/files/perm/idevices/base/electrical-circuits/edition/electrical-circuits.js
@@ -1783,11 +1783,17 @@ var $exeDevice = {
         const questionsJson = [];
         $entries.find('ENTRY').each(function () {
             const $this = $(this),
-                concept = $this.find('CONCEPT').text(),
-                definition = $this
-                    .find('DEFINITION')
-                    .text()
-                    .replace(/<[^>]*>/g, '');
+                concept = $this.find('CONCEPT').text();
+            // Strip HTML tags. Apply the replacement repeatedly until the
+            // string stops changing, because removing one match can splice the
+            // remaining characters into a new tag (e.g. "<<a>script>" ->
+            // "<script>"). A single pass is incomplete sanitization.
+            let definition = $this.find('DEFINITION').text(),
+                previousDefinition;
+            do {
+                previousDefinition = definition;
+                definition = definition.replace(/<[^>]*>/g, '');
+            } while (definition !== previousDefinition);
             if (concept && definition) {
                 questionsJson.push({
                     solution: concept,
diff --git a/public/files/perm/idevices/base/electrical-circuits/edition/electrical-circuits.test.js b/public/files/perm/idevices/base/electrical-circuits/edition/electrical-circuits.test.js
new file mode 100644
index 0000000000..f6faafa575
--- /dev/null
+++ b/public/files/perm/idevices/base/electrical-circuits/edition/electrical-circuits.test.js
@@ -0,0 +1,118 @@
+/**
+ * Unit tests for the Electrical Circuits iDevice (edition code).
+ *
+ * Focus: importGlosary() HTML-tag stripping must be complete sanitization.
+ * A single-pass strip like .replace(/<[^>]*>/g, '') can be defeated because
+ * removing one match can splice the remaining characters into a NEW tag
+ * (e.g. "<scr<script>ipt>" -> "<script>"). The fix applies the replacement
+ * repeatedly until the string stops changing.
+ */
+
+/* eslint-disable no-undef */
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+describe('electrical-circuits iDevice (edition)', () => {
+  let $exeDevice;
+
+  beforeEach(() => {
+    global.$exeDevice = undefined;
+    $exeDevice = global.loadIdevice(join(__dirname, 'electrical-circuits.js'));
+  });
+
+  describe('importGlosary - HTML tag sanitization', () => {
+    /**
+     * Build a minimal Moodle-style glossary XML document with a single entry.
+     * The CONCEPT becomes the solution and the DEFINITION becomes the question.
+     */
+    const buildGlossaryXml = (concept, definition) =>
+      `<?xml version="1.0" encoding="UTF-8"?>` +
+      `<GLOSSARY><INFO><ENTRIES><ENTRY>` +
+      `<CONCEPT>${concept}</CONCEPT>` +
+      `<DEFINITION>${definition}</DEFINITION>` +
+      `</ENTRY></ENTRIES></INFO></GLOSSARY>`;
+
+    /**
+     * Invoke importGlosary with a single glossary entry and return the
+     * imported questions captured from addQuestions().
+     */
+    const importSingleEntry = (concept, definition) => {
+      let captured = null;
+      $exeDevice.addQuestions = vi.fn((questions) => {
+        captured = questions;
+      });
+      $exeDevice.importGlosary(buildGlossaryXml(concept, definition));
+      return captured;
+    };
+
+    it('strips simple HTML tags from the definition', () => {
+      const captured = importSingleEntry('Ohm', '<p>Voltage law</p>');
+      expect(captured).toHaveLength(1);
+      expect(captured[0].quextion).toBe('Voltage law');
+      expect(captured[0].solutionQuestion).toBe('Ohm');
+    });
+
+    it('preserves legitimate plain-text definitions unchanged', () => {
+      const captured = importSingleEntry('Ohm', 'Voltage equals current times resistance');
+      expect(captured).toHaveLength(1);
+      expect(captured[0].quextion).toBe('Voltage equals current times resistance');
+    });
+
+    it('keeps text content while removing surrounding tags', () => {
+      const captured = importSingleEntry('Node', '<b>A</b> point in a <i>circuit</i>');
+      expect(captured).toHaveLength(1);
+      expect(captured[0].quextion).toBe('A point in a circuit');
+    });
+
+    it('leaves no complete HTML tag behind for a nested/obfuscated <script> payload', () => {
+      // The angle brackets must arrive as parsed TEXT (entity-encoded in the
+      // source XML) so that the tag strip in importGlosary actually runs on
+      // them rather than the XML parser swallowing the markup.
+      const captured = importSingleEntry(
+        'XSS',
+        '&lt;scr&lt;script&gt;ipt&gt;alert(1)&lt;/script&gt;'
+      );
+      expect(captured).toHaveLength(1);
+      const definition = captured[0].quextion;
+      // Security property: no complete <...> tag survives, so nothing can be
+      // injected as live markup. In particular no "<script" tag remains, and
+      // the fixed-point loop guarantees a second pass cannot resurrect one.
+      expect(definition.toLowerCase()).not.toContain('<script');
+      expect(definition).not.toMatch(/<[^>]*>/);
+      // The harmless text node content survives.
+      expect(definition).toContain('alert(1)');
+    });
+
+    it('leaves no complete tag behind for interleaved opening brackets', () => {
+      // "<<a>img src=x onerror=alert(1)>after" exercises overlapping brackets;
+      // every complete <...> tag must be gone after stripping.
+      const captured = importSingleEntry(
+        'XSS2',
+        '&lt;&lt;a&gt;img src=x onerror=alert(1)&gt;after'
+      );
+      expect(captured).toHaveLength(1);
+      const definition = captured[0].quextion;
+      expect(definition).not.toMatch(/<[^>]*>/);
+      expect(definition).toContain('after');
+    });
+
+    it('returns false when the XML cannot be parsed', () => {
+      $exeDevice.addQuestions = vi.fn();
+      const result = $exeDevice.importGlosary('<GLOSSARY><ENTRIES');
+      expect(result).toBe(false);
+      expect($exeDevice.addQuestions).not.toHaveBeenCalled();
+    });
+
+    it('returns false when there are no ENTRIES', () => {
+      $exeDevice.addQuestions = vi.fn();
+      const result = $exeDevice.importGlosary(
+        '<?xml version="1.0"?><GLOSSARY><INFO></INFO></GLOSSARY>'
+      );
+      expect(result).toBe(false);
+      expect($exeDevice.addQuestions).not.toHaveBeenCalled();
+    });
+  });
+});
diff --git a/public/files/perm/idevices/base/flipcards/edition/flipcards.js b/public/files/perm/idevices/base/flipcards/edition/flipcards.js
index 7bdd202dcc..cff656b626 100644
--- a/public/files/perm/idevices/base/flipcards/edition/flipcards.js
+++ b/public/files/perm/idevices/base/flipcards/edition/flipcards.js
@@ -592,12 +592,12 @@ var $exeDevice = {
 
     decodeURIComponentSafe: function (s) {
         if (!s) return s;
-        return decodeURIComponent(s).replace('&percnt;', '%');
+        return decodeURIComponent(s).replace(/&percnt;/g, '%');
     },
 
     encodeURIComponentSafe: function (s) {
         if (!s) return s;
-        return encodeURIComponent(s.replace('%', '&percnt;'));
+        return encodeURIComponent(s.replace(/%/g, '&percnt;'));
     },
 
     validateCard: function () {
@@ -1702,11 +1702,16 @@ var $exeDevice = {
         const cardsJson = $entries
             .find('ENTRY')
             .map((_, entry) => {
-                const concept = $(entry).find('CONCEPT').text(),
-                    definition = $(entry)
-                        .find('DEFINITION')
-                        .text()
-                        .replace(/<[^>]*>/g, '');
+                const concept = $(entry).find('CONCEPT').text();
+                let definition = $(entry).find('DEFINITION').text();
+                // Strip tags repeatedly until stable so that removing one
+                // match cannot splice two halves into a new tag
+                // (e.g. "<scr<script>ipt>" -> "<script>").
+                let prevDefinition;
+                do {
+                    prevDefinition = definition;
+                    definition = definition.replace(/<[^>]*>/g, '');
+                } while (definition !== prevDefinition);
                 return concept && definition
                     ? { eText: concept, eTextBk: definition }
                     : null;
diff --git a/public/files/perm/idevices/base/flipcards/edition/flipcards.test.js b/public/files/perm/idevices/base/flipcards/edition/flipcards.test.js
index bb59e86116..33fe350d43 100644
--- a/public/files/perm/idevices/base/flipcards/edition/flipcards.test.js
+++ b/public/files/perm/idevices/base/flipcards/edition/flipcards.test.js
@@ -358,6 +358,85 @@ describe('flipcards iDevice', () => {
     });
   });
 
+  describe('encodeURIComponentSafe / decodeURIComponentSafe', () => {
+    it('encodes every percent sign, not just the first', () => {
+      // Both literal percent signs must be turned into the &percnt; sentinel
+      // (URL-encoded as %26percnt%3B). A first-only replace would leave the
+      // second "%" to be encoded as a bare "%25".
+      const encoded = $exeDevice.encodeURIComponentSafe('50% 60%');
+      // No raw encoded "%" ("%25") should remain.
+      expect(encoded).not.toContain('%25');
+      // Both percents became the &percnt; sentinel.
+      expect((encoded.match(/%26percnt%3B/g) || []).length).toBe(2);
+    });
+
+    it('round-trips a string containing multiple percent signs', () => {
+      const original = '100% sure & 50% done';
+      const restored = $exeDevice.decodeURIComponentSafe(
+        $exeDevice.encodeURIComponentSafe(original),
+      );
+      expect(restored).toBe(original);
+    });
+
+    it('decodes every &percnt; occurrence, not just the first', () => {
+      const decoded = $exeDevice.decodeURIComponentSafe(
+        '&percnt;A&percnt;B&percnt;',
+      );
+      expect(decoded).toBe('%A%B%');
+    });
+
+    it('returns falsy input unchanged', () => {
+      expect($exeDevice.encodeURIComponentSafe('')).toBe('');
+      expect($exeDevice.decodeURIComponentSafe('')).toBe('');
+    });
+  });
+
+  describe('importGlosary tag stripping', () => {
+    const buildGlosaryXml = (concept, definition) =>
+      `<?xml version="1.0"?><GLOSSARY><INFO></INFO><ENTRIES><ENTRY><CONCEPT>${concept}</CONCEPT><DEFINITION>${definition}</DEFINITION></ENTRY></ENTRIES></GLOSSARY>`;
+
+    let captured;
+
+    beforeEach(() => {
+      captured = [];
+      // Stub addCards so we can inspect the parsed cards without pulling in
+      // postImportProcessing / DOM-heavy side effects.
+      $exeDevice.addCards = (cards) => {
+        captured = cards;
+      };
+    });
+
+    it('strips a nested/obfuscated tag payload, leaving no opening tag', () => {
+      // Glossary markup arrives entity-escaped; .text() decodes it back to
+      // real tags, e.g. "<scr<script>ipt>alert(1)</script>safe". The strip
+      // (looped to a fixed point) must remove every "<...>" tag so no
+      // "<script" opening tag survives.
+      const xml = buildGlosaryXml(
+        'Term',
+        '&lt;scr&lt;script&gt;ipt&gt;alert(1)&lt;/script&gt;safe',
+      );
+      $exeDevice.importGlosary(xml);
+      expect(captured.length).toBe(1);
+      const definition = captured[0].eTextBk;
+      // No opening tag (the dangerous part) is left behind.
+      expect(definition.toLowerCase()).not.toContain('<script');
+      expect(definition).not.toContain('<');
+      expect(definition).toContain('safe');
+    });
+
+    it('preserves plain-text definitions unchanged', () => {
+      const xml = buildGlosaryXml('Term', 'A plain definition');
+      $exeDevice.importGlosary(xml);
+      expect(captured.length).toBe(1);
+      expect(captured[0].eText).toBe('Term');
+      expect(captured[0].eTextBk).toBe('A plain definition');
+    });
+
+    it('returns false for malformed XML', () => {
+      expect($exeDevice.importGlosary('not xml at all <<')).toBe(false);
+    });
+  });
+
   describe('addEvents', () => {
     let originalExeDevicesEdition;
 
diff --git a/public/files/perm/idevices/base/guess/edition/guess.js b/public/files/perm/idevices/base/guess/edition/guess.js
index bbefafc1f8..8ca4b9aba3 100644
--- a/public/files/perm/idevices/base/guess/edition/guess.js
+++ b/public/files/perm/idevices/base/guess/edition/guess.js
@@ -2547,11 +2547,15 @@ var $exeDevice = {
 
         const words = [];
         $entries.find('ENTRY').each(function () {
-            const concept = $(this).find('CONCEPT').text(),
-                definition = $(this)
-                    .find('DEFINITION')
-                    .text()
-                    .replace(/<[^>]*>/g, '');
+            const concept = $(this).find('CONCEPT').text();
+            // Strip HTML tags repeatedly until stable: a single pass can splice
+            // two remaining halves into a new tag (e.g. <<a>script> -> <script>).
+            let definition = $(this).find('DEFINITION').text(),
+                prevDefinition;
+            do {
+                prevDefinition = definition;
+                definition = definition.replace(/<[^>]*>/g, '');
+            } while (definition !== prevDefinition);
             if (concept && definition) {
                 let wd = {
                     word: concept,
diff --git a/public/files/perm/idevices/base/guess/edition/guess.test.js b/public/files/perm/idevices/base/guess/edition/guess.test.js
index 87ca46e47c..33200009d6 100644
--- a/public/files/perm/idevices/base/guess/edition/guess.test.js
+++ b/public/files/perm/idevices/base/guess/edition/guess.test.js
@@ -257,6 +257,65 @@ describe('guess iDevice', () => {
     });
   });
 
+  describe('importGlosary', () => {
+    // Build a Moodle GLOSSARY XML document. Definitions are entity-encoded so
+    // that DOMParser yields valid XML while .text() decodes them back into raw
+    // angle-bracket markup that must be stripped by importGlosary.
+    const buildGlosaryXml = (entries) => {
+      const body = entries
+        .map(
+          (e) =>
+            `<ENTRY><CONCEPT>${e.concept}</CONCEPT><DEFINITION>${e.definition}</DEFINITION></ENTRY>`
+        )
+        .join('');
+      return `<GLOSSARY><ENTRIES>${body}</ENTRIES></GLOSSARY>`;
+    };
+
+    it('strips HTML tags from legitimate definitions', () => {
+      let captured;
+      $exeDevice.addWords = (words) => {
+        captured = words;
+      };
+      const xml = buildGlosaryXml([
+        { concept: 'term', definition: '&lt;p&gt;hello&lt;/p&gt; world' },
+      ]);
+      $exeDevice.importGlosary(xml);
+      expect(captured).toHaveLength(1);
+      expect(captured[0].word).toBe('term');
+      expect(captured[0].definition).toBe('hello world');
+    });
+
+    it('removes nested/obfuscated tags to a fixed point (no <script left)', () => {
+      let captured;
+      $exeDevice.addWords = (words) => {
+        captured = words;
+      };
+      // Decodes to: <scr<script>ipt>alert(1)</script>safe
+      const xml = buildGlosaryXml([
+        {
+          concept: 'attack',
+          definition:
+            '&lt;scr&lt;script&gt;ipt&gt;alert(1)&lt;/script&gt;safe',
+        },
+      ]);
+      $exeDevice.importGlosary(xml);
+      expect(captured).toHaveLength(1);
+      // No residual opening-tag markup must remain after the fixed-point loop.
+      expect(captured[0].definition.indexOf('<')).toBe(-1);
+      expect(/<script/i.test(captured[0].definition)).toBe(false);
+      // Legitimate trailing text survives.
+      expect(captured[0].definition).toContain('safe');
+    });
+
+    it('returns false when there is no ENTRIES element', () => {
+      $exeDevice.addWords = () => {
+        throw new Error('addWords should not be called');
+      };
+      const result = $exeDevice.importGlosary('<GLOSSARY></GLOSSARY>');
+      expect(result).toBe(false);
+    });
+  });
+
   describe('i18n', () => {
     it('is defined', () => {
       expect($exeDevice.i18n).toBeDefined();
diff --git a/public/files/perm/idevices/base/interactive-video/edition/interactive-video.js b/public/files/perm/idevices/base/interactive-video/edition/interactive-video.js
index cdca590ca6..fb342e1324 100644
--- a/public/files/perm/idevices/base/interactive-video/edition/interactive-video.js
+++ b/public/files/perm/idevices/base/interactive-video/edition/interactive-video.js
@@ -309,6 +309,23 @@ var $exeDevice = {
         // To do now this.addExtjsScript();
     },
 
+    // Check if a URL points to YouTube.
+    // Parses the URL and matches the hostname exactly so look-alike hosts
+    // such as https://www.youtube.com.evil.com/ are rejected.
+    isYoutubeURL: function (videoURL) {
+        if (!videoURL) {
+            return false;
+        }
+        var hostname;
+        try {
+            hostname = new URL(videoURL).hostname.toLowerCase();
+        } catch (e) {
+            // Invalid URL: keep the original no-match behavior.
+            return false;
+        }
+        return hostname === 'youtube.com' || hostname.endsWith('.youtube.com');
+    },
+
     // Load the saved values in the form fields
     loadPreviousValues: function () {
         var originalHTML = this.idevicePreviousData;
@@ -336,7 +353,7 @@ var $exeDevice = {
                     n = 'MediatecaURL';
                     disabled = false;
                     type = 'mediateca';
-                } else if (videoURL.indexOf('www.youtube.com') > -1) {
+                } else if ($exeDevice.isYoutubeURL(videoURL)) {
                     n = 'YoutubeURL';
                     disabled = false;
                     type = 'youtube';
diff --git a/public/files/perm/idevices/base/interactive-video/edition/interactive-video.test.js b/public/files/perm/idevices/base/interactive-video/edition/interactive-video.test.js
index 49ff779efb..60b318a8fe 100644
--- a/public/files/perm/idevices/base/interactive-video/edition/interactive-video.test.js
+++ b/public/files/perm/idevices/base/interactive-video/edition/interactive-video.test.js
@@ -75,4 +75,26 @@ describe('interactive-video iDevice edition', () => {
     expect(helpIcon.getAttribute('src')).toBe(`${path}quextIEHelp.png`);
     expect(existsSync(join(__dirname, 'quextIEHelp.png'))).toBe(true);
   });
+
+  describe('isYoutubeURL', () => {
+    it('accepts legitimate YouTube watch URLs', () => {
+      expect($exeDevice.isYoutubeURL('https://www.youtube.com/watch?v=g9gPKSGGkEk')).toBe(true);
+      expect($exeDevice.isYoutubeURL('https://youtube.com/watch?v=g9gPKSGGkEk')).toBe(true);
+      expect($exeDevice.isYoutubeURL('https://m.youtube.com/watch?v=g9gPKSGGkEk')).toBe(true);
+    });
+
+    it('rejects look-alike hostnames', () => {
+      // Subdomain attack: host endsWith but is not youtube.com
+      expect($exeDevice.isYoutubeURL('https://www.youtube.com.evil.com/watch?v=x')).toBe(false);
+      // Substring-only attack that the old indexOf(...) > -1 check accepted
+      expect($exeDevice.isYoutubeURL('https://evil.com/?x=www.youtube.com')).toBe(false);
+      expect($exeDevice.isYoutubeURL('https://notyoutube.com/watch?v=x')).toBe(false);
+    });
+
+    it('returns false for invalid or empty input', () => {
+      expect($exeDevice.isYoutubeURL('')).toBe(false);
+      expect($exeDevice.isYoutubeURL(undefined)).toBe(false);
+      expect($exeDevice.isYoutubeURL('not a url')).toBe(false);
+    });
+  });
 });
diff --git a/public/files/perm/idevices/base/interactive-video/export/interactive-video.js b/public/files/perm/idevices/base/interactive-video/export/interactive-video.js
index 5f9e71e20d..a03ed8cc1d 100644
--- a/public/files/perm/idevices/base/interactive-video/export/interactive-video.js
+++ b/public/files/perm/idevices/base/interactive-video/export/interactive-video.js
@@ -760,6 +760,35 @@ var $interactivevideo = {
         }
     },
 
+    /**
+     * Returns the hostname of a URL using strict parsing.
+     *
+     * Protocol-relative URLs (e.g. "//youtu.be/x") are supported by
+     * prefixing "https:" before parsing. Invalid URLs return an empty
+     * string so substring look-alikes (e.g.
+     * "https://www.youtube.com.evil.com/" or
+     * "https://evil.com/?x=//www.youtube.com") never match a real host.
+     */
+    parseHostname: function (url) {
+        if (typeof url !== 'string') return '';
+        var candidate = url.indexOf('//') === 0 ? 'https:' + url : url;
+        try {
+            return new URL(candidate).hostname.toLowerCase();
+        } catch (e) {
+            return '';
+        }
+    },
+
+    /**
+     * Exact host match: hostname must equal `host` or be a subdomain of it
+     * (".host"). Avoids the incomplete-substring sanitization where
+     * "host.evil.com" or "evil.com/?x=host" would incorrectly match.
+     */
+    hostMatches: function (url, host) {
+        var hostname = this.parseHostname(url);
+        return hostname === host || hostname.endsWith('.' + host);
+    },
+
     getTypeAndId: function () {
         var w = $('#exe-interactive-video-file');
 
@@ -768,7 +797,10 @@ var $interactivevideo = {
         if (as.length == 1) {
             var ref = as.eq(0).attr('href');
             // Mediateca (EducaMadrid)
-            if (ref.indexOf('https://mediateca.educa.madrid.org/video/') == 0) {
+            if (
+                this.hostMatches(ref, 'mediateca.educa.madrid.org') &&
+                ref.indexOf('https://mediateca.educa.madrid.org/video/') == 0
+            ) {
                 this.type = 'mediateca';
                 this.id = ref
                     .split('https://mediateca.educa.madrid.org/video/')[1]
@@ -777,8 +809,8 @@ var $interactivevideo = {
             }
             // Youtube
             else if (
-                ref.indexOf('//youtu.be/') > -1 ||
-                ref.indexOf('//www.youtube.com') > -1
+                this.hostMatches(ref, 'youtu.be') ||
+                this.hostMatches(ref, 'youtube.com')
             ) {
                 function youtube_parser(url) {
                     var match = url.match(regExp);
diff --git a/public/files/perm/idevices/base/interactive-video/export/interactive-video.test.js b/public/files/perm/idevices/base/interactive-video/export/interactive-video.test.js
index ff94d0320c..fe34adb588 100644
--- a/public/files/perm/idevices/base/interactive-video/export/interactive-video.test.js
+++ b/public/files/perm/idevices/base/interactive-video/export/interactive-video.test.js
@@ -560,4 +560,130 @@ describe('interactive-video iDevice export', () => {
       expect(typeof $interactivevideo.controls.seek).toBe('function');
     });
   });
+
+  describe('parseHostname', () => {
+    it('returns the lowercased hostname for an absolute URL', () => {
+      expect($interactivevideo.parseHostname('https://WWW.YouTube.com/watch?v=abc')).toBe('www.youtube.com');
+    });
+
+    it('supports protocol-relative URLs', () => {
+      expect($interactivevideo.parseHostname('//youtu.be/dQw4w9WgXcQ')).toBe('youtu.be');
+    });
+
+    it('returns empty string for invalid URLs', () => {
+      expect($interactivevideo.parseHostname('not a url')).toBe('');
+      expect($interactivevideo.parseHostname('resources/video.mp4')).toBe('');
+    });
+
+    it('returns empty string for non-string input', () => {
+      expect($interactivevideo.parseHostname(undefined)).toBe('');
+      expect($interactivevideo.parseHostname(null)).toBe('');
+      expect($interactivevideo.parseHostname(42)).toBe('');
+    });
+  });
+
+  describe('hostMatches', () => {
+    it('matches an exact host', () => {
+      expect($interactivevideo.hostMatches('https://youtu.be/abc', 'youtu.be')).toBe(true);
+    });
+
+    it('matches a subdomain of the host', () => {
+      expect($interactivevideo.hostMatches('https://www.youtube.com/watch', 'youtube.com')).toBe(true);
+      expect($interactivevideo.hostMatches('https://m.youtube.com/watch', 'youtube.com')).toBe(true);
+    });
+
+    it('rejects look-alike hosts (suffix attack)', () => {
+      expect($interactivevideo.hostMatches('https://www.youtube.com.evil.com/watch', 'youtube.com')).toBe(false);
+      expect($interactivevideo.hostMatches('https://youtu.be.evil.com/abc', 'youtu.be')).toBe(false);
+    });
+
+    it('rejects hosts embedded in the path or query (substring attack)', () => {
+      expect($interactivevideo.hostMatches('https://evil.com/?x=//www.youtube.com', 'youtube.com')).toBe(false);
+      expect($interactivevideo.hostMatches('https://evil.com/youtu.be/abc', 'youtu.be')).toBe(false);
+    });
+  });
+
+  describe('getTypeAndId host detection', () => {
+    let originalAlert;
+
+    function withHref(href, length) {
+      const linkCount = length === undefined ? 1 : length;
+      global.$ = (selector) => {
+        // $('a', w) returns the anchor collection; $('#...') returns the wrapper.
+        if (selector === 'a') {
+          return {
+            length: linkCount,
+            eq: () => ({ attr: () => href }),
+          };
+        }
+        return { length: linkCount, eq: () => ({ attr: () => href }) };
+      };
+      global.$.fn = {};
+    }
+
+    beforeEach(() => {
+      originalAlert = global.alert;
+      global.alert = vi.fn();
+      global.InteractiveVideo = {
+        i18n: { error: 'Error', dataError: 'Data error' },
+      };
+      // Reset detection state
+      $interactivevideo.type = undefined;
+      $interactivevideo.id = undefined;
+      $interactivevideo.file = undefined;
+      $interactivevideo.extension = undefined;
+    });
+
+    afterEach(() => {
+      global.alert = originalAlert;
+    });
+
+    it('detects a legitimate YouTube URL', () => {
+      withHref('https://www.youtube.com/watch?v=dQw4w9WgXcQ');
+      $interactivevideo.getTypeAndId();
+      expect($interactivevideo.type).toBe('youtube');
+      expect($interactivevideo.id).toBe('dQw4w9WgXcQ');
+    });
+
+    it('detects a legitimate youtu.be short URL', () => {
+      withHref('https://youtu.be/dQw4w9WgXcQ');
+      $interactivevideo.getTypeAndId();
+      expect($interactivevideo.type).toBe('youtube');
+      expect($interactivevideo.id).toBe('dQw4w9WgXcQ');
+    });
+
+    it('detects a legitimate Mediateca URL', () => {
+      withHref('https://mediateca.educa.madrid.org/video/abc123?foo=bar');
+      $interactivevideo.getTypeAndId();
+      expect($interactivevideo.type).toBe('mediateca');
+      expect($interactivevideo.id).toBe('abc123');
+    });
+
+    it('detects a local resource', () => {
+      withHref('resources/myvideo.mp4');
+      $interactivevideo.getTypeAndId();
+      expect($interactivevideo.type).toBe('local');
+      expect($interactivevideo.file).toBe('resources/myvideo.mp4');
+      expect($interactivevideo.extension).toBe('mp4');
+    });
+
+    it('rejects a YouTube look-alike host and does not classify as youtube', () => {
+      withHref('https://www.youtube.com.evil.com/watch?v=dQw4w9WgXcQ');
+      $interactivevideo.getTypeAndId();
+      expect($interactivevideo.type).not.toBe('youtube');
+      expect(global.alert).toHaveBeenCalled();
+    });
+
+    it('rejects a Mediateca look-alike host', () => {
+      withHref('https://mediateca.educa.madrid.org.evil.com/video/abc123');
+      $interactivevideo.getTypeAndId();
+      expect($interactivevideo.type).not.toBe('mediateca');
+    });
+
+    it('does nothing when there is not exactly one anchor', () => {
+      withHref('https://www.youtube.com/watch?v=dQw4w9WgXcQ', 0);
+      $interactivevideo.getTypeAndId();
+      expect($interactivevideo.type).toBeUndefined();
+    });
+  });
 });
diff --git a/public/files/perm/idevices/base/mathproblems/edition/mathproblems.js b/public/files/perm/idevices/base/mathproblems/edition/mathproblems.js
index 5938ef31cc..c4402e37ae 100644
--- a/public/files/perm/idevices/base/mathproblems/edition/mathproblems.js
+++ b/public/files/perm/idevices/base/mathproblems/edition/mathproblems.js
@@ -667,7 +667,7 @@ var $exeDevice = {
         } else if (p.wording.trim().length == 0) {
             message = _('Please write the question text');
         } else {
-            let expresion = /\{[a-zA-z]\}/g,
+            let expresion = /\{[a-zA-Z]\}/g,
                 vfs = p.formula.split('|'),
                 vw = p.wording.match(expresion);
             for (let i = 0; i < vfs.length; i++) {
diff --git a/public/files/perm/idevices/base/mathproblems/export/mathproblems.js b/public/files/perm/idevices/base/mathproblems/export/mathproblems.js
index fddf1b94fe..09812ca94c 100644
--- a/public/files/perm/idevices/base/mathproblems/export/mathproblems.js
+++ b/public/files/perm/idevices/base/mathproblems/export/mathproblems.js
@@ -338,7 +338,7 @@ var $eXeMathProblems = {
     },
 
     loadProblems: function (options) {
-        const expresion = /\{[a-zA-z]\}/g;
+        const expresion = /\{[a-zA-Z]\}/g;
         for (let i = 0; i < options.questions.length; i++) {
             let text = options.questions[i].wordingseg,
                 fms = options.questions[i].formula.split('|'),
diff --git a/public/files/perm/idevices/base/mathproblems/export/mathproblems.test.js b/public/files/perm/idevices/base/mathproblems/export/mathproblems.test.js
new file mode 100644
index 0000000000..fd8db67f3e
--- /dev/null
+++ b/public/files/perm/idevices/base/mathproblems/export/mathproblems.test.js
@@ -0,0 +1,58 @@
+/**
+ * Unit tests for mathproblems iDevice — placeholder-matching regex.
+ *
+ * The export and edition runtimes locate `{X}` answer placeholders with a
+ * regex character class. It previously read `[a-zA-z]`, an overly-large range
+ * (CodeQL js/overly-large-range): `A-z` spans the six ASCII punctuation
+ * characters between `Z` and `a` (`[ \ ] ^ _ ` `), so `{[}`, `{\}`, `{^}` etc.
+ * were wrongly treated as placeholders. The fix narrows it to `[a-zA-Z]`.
+ *
+ * Both runtime twins (export + edition) embed this regex inline with no module
+ * seam, so these tests (a) guard against the broad range reappearing in either
+ * file and (b) assert the intended letters-only matching semantics.
+ */
+
+import { readFileSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+const TWINS = {
+    export: join(__dirname, 'mathproblems.js'),
+    edition: join(__dirname, '..', 'edition', 'mathproblems.js'),
+};
+
+describe('mathproblems placeholder regex', () => {
+    describe('regression guard — no overly-large range in either twin', () => {
+        for (const [name, path] of Object.entries(TWINS)) {
+            it(`${name} runtime uses [a-zA-Z], never [a-zA-z]`, () => {
+                const code = readFileSync(path, 'utf-8');
+                expect(code).not.toMatch(/\[a-zA-z\]/);
+                expect(code).toContain('/\\{[a-zA-Z]\\}/g');
+            });
+        }
+    });
+
+    describe('matching semantics of /\\{[a-zA-Z]\\}/g', () => {
+        const placeholder = () => /\{[a-zA-Z]\}/g;
+
+        it('matches single-letter placeholders', () => {
+            for (const token of ['{x}', '{A}', '{Z}', '{a}', '{m}']) {
+                expect(token.match(placeholder())).toEqual([token]);
+            }
+        });
+
+        it('does NOT match the punctuation chars that [a-zA-z] wrongly included', () => {
+            for (const token of ['{[}', '{\\}', '{]}', '{^}', '{_}', '{`}']) {
+                expect(token.match(placeholder())).toBeNull();
+            }
+        });
+
+        it('finds every placeholder in a wording string', () => {
+            const wording = 'Solve {a} plus {B} for the value {z}.';
+            expect(wording.match(placeholder())).toEqual(['{a}', '{B}', '{z}']);
+        });
+    });
+});
diff --git a/public/files/perm/idevices/base/quick-questions-video/export/quick-questions-video.js b/public/files/perm/idevices/base/quick-questions-video/export/quick-questions-video.js
index 5cb272e2fb..0ff163da44 100644
--- a/public/files/perm/idevices/base/quick-questions-video/export/quick-questions-video.js
+++ b/public/files/perm/idevices/base/quick-questions-video/export/quick-questions-video.js
@@ -566,14 +566,23 @@ var $quickquestionsvideo = {
 
     getIDMediaTeca: function (url) {
         if (url) {
-            const matc =
-                url.indexOf('https://mediateca.educa.madrid.org/video/') != -1;
-            if (matc) {
-                let id = url
-                    .split('https://mediateca.educa.madrid.org/video/')[1]
-                    .split('?')[0];
-                id = 'http://mediateca.educa.madrid.org/streaming.php?id=' + id;
-                return id;
+            let parsed;
+            try {
+                parsed = new URL(url);
+            } catch (e) {
+                return '';
+            }
+            const prefix = '/video/';
+            if (
+                parsed.protocol === 'https:' &&
+                parsed.hostname === 'mediateca.educa.madrid.org' &&
+                parsed.pathname.indexOf(prefix) === 0 &&
+                parsed.pathname.length > prefix.length
+            ) {
+                const id = parsed.pathname.slice(prefix.length);
+                return (
+                    'http://mediateca.educa.madrid.org/streaming.php?id=' + id
+                );
             } else {
                 return '';
             }
diff --git a/public/files/perm/idevices/base/quick-questions-video/export/quick-questions-video.test.js b/public/files/perm/idevices/base/quick-questions-video/export/quick-questions-video.test.js
new file mode 100644
index 0000000000..5547688d53
--- /dev/null
+++ b/public/files/perm/idevices/base/quick-questions-video/export/quick-questions-video.test.js
@@ -0,0 +1,133 @@
+/**
+ * Unit tests for quick-questions-video iDevice (export/runtime)
+ *
+ * Focused on getIDMediaTeca, which resolves Mediateca (educa.madrid.org)
+ * video sharing URLs into streaming URLs. The resolution must validate the
+ * host/path exactly so that look-alike URLs cannot be smuggled through
+ * (incomplete-url-substring-sanitization).
+ */
+
+/* eslint-disable no-undef */
+import { readFileSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+/**
+ * Helper to load export iDevice file and expose $quickquestionsvideo globally.
+ * Replaces 'var $quickquestionsvideo' with 'global.$quickquestionsvideo' to
+ * make it accessible from the test.
+ */
+function loadExportIdevice(code) {
+  const modifiedCode = code.replace(
+    /var\s+\$quickquestionsvideo\s*=/,
+    'global.$quickquestionsvideo =',
+  );
+
+  // eslint-disable-next-line no-eval
+  (0, eval)(modifiedCode);
+  return global.$quickquestionsvideo;
+}
+
+describe('quick-questions-video iDevice export', () => {
+  let $quickquestionsvideo;
+
+  beforeEach(() => {
+    global.$quickquestionsvideo = undefined;
+    // Mock jQuery. The trailing `$(function () { ... })` ready handler must not
+    // execute init() during eval, so the callback is simply ignored.
+    global.$ = () => ({ html: () => {}, eq: () => ({ attr: () => '' }), length: 0 });
+    global.$.fn = {};
+
+    const filePath = join(__dirname, 'quick-questions-video.js');
+    const code = readFileSync(filePath, 'utf-8');
+
+    $quickquestionsvideo = loadExportIdevice(code);
+  });
+
+  afterEach(() => {
+    delete global.$quickquestionsvideo;
+    delete global.$;
+  });
+
+  describe('getIDMediaTeca', () => {
+    it('resolves a legitimate Mediateca video sharing URL', () => {
+      const result = $quickquestionsvideo.getIDMediaTeca(
+        'https://mediateca.educa.madrid.org/video/ABC123',
+      );
+      expect(result).toBe(
+        'http://mediateca.educa.madrid.org/streaming.php?id=ABC123',
+      );
+    });
+
+    it('strips the query string when extracting the id', () => {
+      const result = $quickquestionsvideo.getIDMediaTeca(
+        'https://mediateca.educa.madrid.org/video/ABC123?autoplay=1',
+      );
+      expect(result).toBe(
+        'http://mediateca.educa.madrid.org/streaming.php?id=ABC123',
+      );
+    });
+
+    it('preserves nested path segments after /video/', () => {
+      const result = $quickquestionsvideo.getIDMediaTeca(
+        'https://mediateca.educa.madrid.org/video/ABC/DEF',
+      );
+      expect(result).toBe(
+        'http://mediateca.educa.madrid.org/streaming.php?id=ABC/DEF',
+      );
+    });
+
+    it('rejects a look-alike host (subdomain attack)', () => {
+      expect(
+        $quickquestionsvideo.getIDMediaTeca(
+          'https://mediateca.educa.madrid.org.evil.com/video/ABC123',
+        ),
+      ).toBe('');
+    });
+
+    it('rejects a URL that only embeds the target as a query parameter', () => {
+      expect(
+        $quickquestionsvideo.getIDMediaTeca(
+          'https://evil.com/?x=https://mediateca.educa.madrid.org/video/ABC123',
+        ),
+      ).toBe('');
+    });
+
+    it('rejects the correct host on a non-/video/ path', () => {
+      expect(
+        $quickquestionsvideo.getIDMediaTeca(
+          'https://mediateca.educa.madrid.org/audio/ABC123',
+        ),
+      ).toBe('');
+    });
+
+    it('rejects the correct host and path over plain http', () => {
+      expect(
+        $quickquestionsvideo.getIDMediaTeca(
+          'http://mediateca.educa.madrid.org/video/ABC123',
+        ),
+      ).toBe('');
+    });
+
+    it('rejects an empty /video/ path with no id', () => {
+      expect(
+        $quickquestionsvideo.getIDMediaTeca(
+          'https://mediateca.educa.madrid.org/video/',
+        ),
+      ).toBe('');
+    });
+
+    it('returns empty string for an invalid URL', () => {
+      expect($quickquestionsvideo.getIDMediaTeca('not a url')).toBe('');
+    });
+
+    it('returns empty string for a falsy input', () => {
+      expect($quickquestionsvideo.getIDMediaTeca('')).toBe('');
+      expect($quickquestionsvideo.getIDMediaTeca(undefined)).toBe('');
+      expect($quickquestionsvideo.getIDMediaTeca(null)).toBe('');
+    });
+  });
+});
diff --git a/public/files/perm/idevices/base/relate/edition/relate.js b/public/files/perm/idevices/base/relate/edition/relate.js
index 5c2ce4bb54..c5cc3de9e2 100644
--- a/public/files/perm/idevices/base/relate/edition/relate.js
+++ b/public/files/perm/idevices/base/relate/edition/relate.js
@@ -618,11 +618,11 @@ var $exeDevice = {
     },
 
     decodeURIComponentSafe: function (s) {
-        return s ? decodeURIComponent(s).replace('&percnt;', '%') : s;
+        return s ? decodeURIComponent(s).replace(/&percnt;/g, '%') : s;
     },
 
     encodeURIComponentSafe: function (s) {
-        return s ? encodeURIComponent(s.replace('%', '&percnt;')) : s;
+        return s ? encodeURIComponent(s.replace(/%/g, '&percnt;')) : s;
     },
 
     validateCard: function () {
@@ -1592,11 +1592,16 @@ var $exeDevice = {
         const cardsJson = [];
         $entries.find('ENTRY').each(function () {
             const $this = $(this),
-                concept = $this.find('CONCEPT').text(),
-                definition = $this
-                    .find('DEFINITION')
-                    .text()
-                    .replace(/<[^>]*>/g, ''); // Elimina HTML
+                concept = $this.find('CONCEPT').text();
+            // Elimina HTML. Se repite hasta que el resultado deja de cambiar
+            // para evitar que etiquetas anidadas (p.ej. "<scr<script>ipt>")
+            // se recompongan tras una sola pasada.
+            let definition = $this.find('DEFINITION').text(),
+                prevDefinition;
+            do {
+                prevDefinition = definition;
+                definition = definition.replace(/<[^>]*>/g, '');
+            } while (definition !== prevDefinition);
             if (concept && definition) {
                 cardsJson.push({
                     eText: concept,
@@ -1742,11 +1747,16 @@ var $exeDevice = {
         const cardsJson = $entries
             .find('ENTRY')
             .map((_, entry) => {
-                const concept = $(entry).find('CONCEPT').text(),
-                    definition = $(entry)
-                        .find('DEFINITION')
-                        .text()
-                        .replace(/<[^>]*>/g, '');
+                const concept = $(entry).find('CONCEPT').text();
+                // Elimina HTML. Se repite hasta que el resultado deja de
+                // cambiar para evitar que etiquetas anidadas
+                // (p.ej. "<scr<script>ipt>") se recompongan tras una sola pasada.
+                let definition = $(entry).find('DEFINITION').text(),
+                    prevDefinition;
+                do {
+                    prevDefinition = definition;
+                    definition = definition.replace(/<[^>]*>/g, '');
+                } while (definition !== prevDefinition);
                 return concept && definition
                     ? { eText: concept, eTextBk: definition }
                     : null;
diff --git a/public/files/perm/idevices/base/relate/edition/relate.test.js b/public/files/perm/idevices/base/relate/edition/relate.test.js
new file mode 100644
index 0000000000..e87cdebf5b
--- /dev/null
+++ b/public/files/perm/idevices/base/relate/edition/relate.test.js
@@ -0,0 +1,124 @@
+/**
+ * Unit tests for relate iDevice (edition code).
+ *
+ * Focused on the sanitization helpers flagged by CodeQL:
+ * - encodeURIComponentSafe / decodeURIComponentSafe: percent escaping must be
+ *   global so that strings with more than one '%' round-trip correctly
+ *   (incomplete-sanitization).
+ * - importGlosary: HTML stripping of glossary definitions must be applied
+ *   repeatedly until stable so nested/obfuscated tags cannot be recomposed
+ *   (incomplete-multi-character-sanitization).
+ *
+ * iDevice files use 'var $exeDevice = {...}', so they are loaded via the
+ * global.loadIdevice helper (see public/vitest.setup.js).
+ */
+
+/* eslint-disable no-undef */
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+describe('relate iDevice (edition)', () => {
+  let $exeDevice;
+
+  beforeEach(() => {
+    global.$exeDevice = undefined;
+    $exeDevice = global.loadIdevice(join(__dirname, 'relate.js'));
+  });
+
+  describe('encodeURIComponentSafe / decodeURIComponentSafe', () => {
+    it('escapes every percent sign, not just the first', () => {
+      // Before the fix, only the first '%' was escaped (replace without /g).
+      const encoded = $exeDevice.encodeURIComponentSafe('a%b%c');
+      // No raw '%' from the original input should survive un-escaped.
+      expect(encoded).toBe('a%26percnt%3Bb%26percnt%3Bc');
+    });
+
+    it('round-trips a string containing multiple percent signs', () => {
+      const original = '50% off, 100% sure, 0% risk';
+      const encoded = $exeDevice.encodeURIComponentSafe(original);
+      const decoded = $exeDevice.decodeURIComponentSafe(encoded);
+      expect(decoded).toBe(original);
+    });
+
+    it('round-trips a single percent sign', () => {
+      const original = 'value is 25%';
+      const encoded = $exeDevice.encodeURIComponentSafe(original);
+      expect($exeDevice.decodeURIComponentSafe(encoded)).toBe(original);
+    });
+
+    it('round-trips a string with no percent signs', () => {
+      const original = 'plain text';
+      const encoded = $exeDevice.encodeURIComponentSafe(original);
+      expect($exeDevice.decodeURIComponentSafe(encoded)).toBe(original);
+    });
+
+    it('returns falsy input unchanged for encode', () => {
+      expect($exeDevice.encodeURIComponentSafe('')).toBe('');
+      expect($exeDevice.encodeURIComponentSafe(undefined)).toBe(undefined);
+    });
+
+    it('returns falsy input unchanged for decode', () => {
+      expect($exeDevice.decodeURIComponentSafe('')).toBe('');
+      expect($exeDevice.decodeURIComponentSafe(undefined)).toBe(undefined);
+    });
+  });
+
+  describe('importGlosary HTML stripping', () => {
+    const buildGlossaryXml = (definition) =>
+      `<?xml version="1.0" encoding="UTF-8"?>` +
+      `<GLOSSARY><INFO></INFO><ENTRIES><ENTRY>` +
+      `<CONCEPT>Term</CONCEPT>` +
+      `<DEFINITION>${definition}</DEFINITION>` +
+      `</ENTRY></ENTRIES></GLOSSARY>`;
+
+    beforeEach(() => {
+      // importGlosary pushes parsed cards into cardsGame and then runs
+      // postImportProcessing(), which touches DOM that is irrelevant to the
+      // sanitization behavior under test. Isolate the sanitization path by
+      // stubbing postImportProcessing and starting from an empty list.
+      $exeDevice.cardsGame = [];
+      $exeDevice.postImportProcessing = () => {};
+    });
+
+    it('strips simple HTML tags from definitions', () => {
+      $exeDevice.importGlosary(buildGlossaryXml('<b>Hello</b> world'));
+      expect($exeDevice.cardsGame).toHaveLength(1);
+      expect($exeDevice.cardsGame[0].eTextBk).toBe('Hello world');
+    });
+
+    it('strips nested/obfuscated tag payloads, leaving no tag opener behind', () => {
+      // Entity-encoding in the XML means DEFINITION.text() decodes back to the
+      // literal payload with "<script" substrings, reproducing the seam the
+      // sanitizer operates on. The fixed-point loop guarantees the output is
+      // stable: re-running the strip cannot expose any further "<...>" tag.
+      const encoded =
+        '&lt;scr&lt;script&gt;ipt&gt;alert(1)&lt;/scr&lt;/script&gt;ipt&gt;safe';
+      $exeDevice.importGlosary(buildGlossaryXml(encoded));
+      expect($exeDevice.cardsGame).toHaveLength(1);
+      const cleaned = $exeDevice.cardsGame[0].eTextBk;
+      // The security property: no tag-opener survives, so no "<script" (or any
+      // other tag) remains, and a further strip pass would be a no-op.
+      expect(cleaned.toLowerCase()).not.toContain('<script');
+      expect(cleaned).not.toContain('<');
+      expect(cleaned).toBe(cleaned.replace(/<[^>]*>/g, ''));
+      // The non-tag text survives the sanitization.
+      expect(cleaned).toContain('safe');
+      expect(cleaned).toContain('alert(1)');
+    });
+
+    it('keeps plain-text definitions untouched', () => {
+      $exeDevice.importGlosary(buildGlossaryXml('A plain definition'));
+      expect($exeDevice.cardsGame).toHaveLength(1);
+      expect($exeDevice.cardsGame[0].eTextBk).toBe('A plain definition');
+    });
+
+    it('returns false when there are no glossary entries', () => {
+      const emptyXml =
+        `<?xml version="1.0" encoding="UTF-8"?><GLOSSARY></GLOSSARY>`;
+      expect($exeDevice.importGlosary(emptyXml)).toBe(false);
+    });
+  });
+});
diff --git a/public/files/perm/idevices/base/slide/export/slide.js b/public/files/perm/idevices/base/slide/export/slide.js
index ad0159b8c6..415b125f7a 100644
--- a/public/files/perm/idevices/base/slide/export/slide.js
+++ b/public/files/perm/idevices/base/slide/export/slide.js
@@ -42,13 +42,33 @@ var $slide = (() => {
         if (!svg || typeof svg !== 'string') {
             return '';
         }
-        return svg
-            .replace(/<script[\s\S]*?<\/script>/gi, '')
-            .replace(/\son[a-z]+\s*=\s*"[^"]*"/gi, '')
-            .replace(/\son[a-z]+\s*=\s*'[^']*'/gi, '')
-            // Unquoted handler values: stop at whitespace or '>' (also '/>').
-            .replace(/\son[a-z]+\s*=\s*[^\s>]+/gi, '')
-            .replace(/javascript:/gi, '');
+        // Apply every removal repeatedly until the string stops changing.
+        // A single pass can be defeated because deleting one match can splice
+        // two halves into a brand-new match (e.g. `<scr<script>ipt>` ->
+        // `<script>`, or `javasjavascript:cript:` -> `javascript:`). Looping
+        // to a fixed point closes that hole. The end-tag pattern tolerates
+        // optional whitespace before the closing angle bracket (`</script >`)
+        // and is case-insensitive.
+        var prev;
+        var out = svg;
+        do {
+            prev = out;
+            out = out
+                .replace(/<script[\s\S]*?<\/\s*script\s*>/gi, '')
+                .replace(/<\/?\s*foreignObject[^>]*>/gi, '')
+                .replace(/\son[a-z]+\s*=\s*"[^"]*"/gi, '')
+                .replace(/\son[a-z]+\s*=\s*'[^']*'/gi, '')
+                // Unquoted handler values: stop at whitespace or '>' (also '/>').
+                .replace(/\son[a-z]+\s*=\s*[^\s>]+/gi, '')
+                // Dangerous URL schemes. `javascript:` and `vbscript:` are
+                // always unsafe and are removed outright. For `data:` we only
+                // strip the script-executing `data:text/html` form so
+                // legitimate embedded images (`data:image/...`) keep working.
+                .replace(/javascript:/gi, '')
+                .replace(/vbscript:/gi, '')
+                .replace(/data:\s*text\/html/gi, '');
+        } while (out !== prev);
+        return out;
     }
 
     /**
diff --git a/public/files/perm/idevices/base/slide/export/slide.test.js b/public/files/perm/idevices/base/slide/export/slide.test.js
index db096a03ba..d7f0ead652 100644
--- a/public/files/perm/idevices/base/slide/export/slide.test.js
+++ b/public/files/perm/idevices/base/slide/export/slide.test.js
@@ -120,6 +120,44 @@ describe('$slide._scrubSvg', () => {
         expect(_scrubSvg(42)).toBe('');
         expect(_scrubSvg('')).toBe('');
     });
+
+    it('defeats nested/spliced <script> payloads (loops to a fixed point)', () => {
+        const out = _scrubSvg('<svg><scr<script>alert(1)</script>ipt>x</scr<script>y</script>ipt></svg>');
+        expect(out.toLowerCase()).not.toContain('<script');
+        expect(out).not.toContain('alert(1)');
+    });
+
+    it('removes <script> end tags with whitespace before the angle bracket', () => {
+        const out = _scrubSvg('<svg><script>alert(1)</script >\n<rect/></svg>');
+        expect(out.toLowerCase()).not.toContain('<script');
+        expect(out).not.toContain('alert(1)');
+        expect(out).toContain('<rect');
+    });
+
+    it('strips vbscript: URLs (case-insensitive)', () => {
+        expect(_scrubSvg('<svg><a href="vbscript:msgbox(1)"></a></svg>')).not.toContain('vbscript:');
+        expect(_scrubSvg('<svg><a href="VBScript:msgbox(1)"></a></svg>').toLowerCase()).not.toContain('vbscript:');
+    });
+
+    it('defeats spliced javascript: schemes (loops to a fixed point)', () => {
+        const out = _scrubSvg('<svg><a href="javasjavascript:cript:alert(1)"></a></svg>');
+        expect(out.toLowerCase()).not.toContain('javascript:');
+    });
+
+    it('strips script-executing data:text/html URLs', () => {
+        const out = _scrubSvg('<svg><a href="data:text/html,<script>alert(1)</script>"></a></svg>');
+        expect(out.toLowerCase()).not.toContain('data:text/html');
+    });
+
+    it('keeps legitimate embedded data:image URLs intact', () => {
+        const svg = '<svg><image href="data:image/png;base64,AAAA"/></svg>';
+        expect(_scrubSvg(svg)).toContain('data:image/png;base64,AAAA');
+    });
+
+    it('strips <foreignObject> (which can embed arbitrary HTML), matching the src twin', () => {
+        const out = _scrubSvg('<svg><foreignObject><div onclick="x">hi</div></foreignObject></svg>');
+        expect(out.toLowerCase()).not.toContain('foreignobject');
+    });
 });
 
 // ─────────────────────────────────────────────────────────────────────────────
diff --git a/public/files/perm/idevices/base/slide/src/sanitizer.test.js b/public/files/perm/idevices/base/slide/src/sanitizer.test.js
index f83db5d8d7..b80ae6b654 100644
--- a/public/files/perm/idevices/base/slide/src/sanitizer.test.js
+++ b/public/files/perm/idevices/base/slide/src/sanitizer.test.js
@@ -40,6 +40,42 @@ describe('scrubSvg', () => {
         const out = scrubSvg('<svg><foreignObject><div onclick="x"/></foreignObject></svg>');
         expect(out).not.toContain('foreignObject');
     });
+
+    it('defeats nested/spliced <script> payloads (loops to a fixed point)', () => {
+        // Removing the inner <script>…</script> would splice the outer halves
+        // into a fresh <script> a single pass would leave behind.
+        const out = scrubSvg('<svg><scr<script>alert(1)</script>ipt>x</scr<script>y</script>ipt></svg>');
+        expect(out.toLowerCase()).not.toContain('<script');
+        expect(out).not.toContain('alert(1)');
+    });
+
+    it('removes <script> end tags with whitespace before the angle bracket', () => {
+        const out = scrubSvg('<svg><script>alert(1)</script >\n<rect/></svg>');
+        expect(out.toLowerCase()).not.toContain('<script');
+        expect(out).not.toContain('alert(1)');
+        expect(out).toContain('<rect');
+    });
+
+    it('strips vbscript: URLs', () => {
+        expect(scrubSvg('<svg><a href="vbscript:msgbox(1)"></a></svg>')).not.toContain('vbscript:');
+        expect(scrubSvg('<svg><a href="VBScript:msgbox(1)"></a></svg>').toLowerCase()).not.toContain('vbscript:');
+    });
+
+    it('defeats spliced javascript: schemes (loops to a fixed point)', () => {
+        // `javasjavascript:cript:` collapses to `javascript:` after one removal.
+        const out = scrubSvg('<svg><a href="javasjavascript:cript:alert(1)"></a></svg>');
+        expect(out.toLowerCase()).not.toContain('javascript:');
+    });
+
+    it('strips script-executing data:text/html URLs', () => {
+        const out = scrubSvg('<svg><a href="data:text/html,<script>alert(1)</script>"></a></svg>');
+        expect(out.toLowerCase()).not.toContain('data:text/html');
+    });
+
+    it('keeps legitimate embedded data:image URLs intact', () => {
+        const svg = '<svg><image href="data:image/png;base64,AAAA"/></svg>';
+        expect(scrubSvg(svg)).toContain('data:image/png;base64,AAAA');
+    });
 });
 
 describe('sanitizeSvg', () => {
diff --git a/public/files/perm/idevices/base/slide/src/sanitizer.ts b/public/files/perm/idevices/base/slide/src/sanitizer.ts
index 6079102c37..87edcdae9d 100644
--- a/public/files/perm/idevices/base/slide/src/sanitizer.ts
+++ b/public/files/perm/idevices/base/slide/src/sanitizer.ts
@@ -25,13 +25,31 @@ type DomPurifyLike = {
  */
 export function scrubSvg(svg: unknown): string {
     if (!svg || typeof svg !== 'string') return '';
-    return svg
-        .replace(/<script[\s\S]*?<\/script>/gi, '')
-        .replace(/<\/?\s*foreignObject[^>]*>/gi, '')
-        .replace(/\son[a-z]+\s*=\s*"[^"]*"/gi, '')
-        .replace(/\son[a-z]+\s*=\s*'[^']*'/gi, '')
-        .replace(/\son[a-z]+\s*=\s*[^\s>]+/gi, '')
-        .replace(/javascript:/gi, '');
+    // Apply every removal repeatedly until the string stops changing.
+    // A single pass can be defeated because deleting one match can splice
+    // two halves into a brand-new match (e.g. `<scr<script>ipt>` -> `<script>`,
+    // or `javasjavascript:cript:` -> `javascript:`). Looping to a fixed point
+    // closes that hole. The end-tag pattern tolerates optional whitespace
+    // before the closing angle bracket (`</script >`) and is case-insensitive.
+    let prev: string;
+    let out = svg;
+    do {
+        prev = out;
+        out = out
+            .replace(/<script[\s\S]*?<\/\s*script\s*>/gi, '')
+            .replace(/<\/?\s*foreignObject[^>]*>/gi, '')
+            .replace(/\son[a-z]+\s*=\s*"[^"]*"/gi, '')
+            .replace(/\son[a-z]+\s*=\s*'[^']*'/gi, '')
+            .replace(/\son[a-z]+\s*=\s*[^\s>]+/gi, '')
+            // Dangerous URL schemes. `javascript:` and `vbscript:` are always
+            // unsafe and are removed outright. For `data:` we only strip the
+            // script-executing `data:text/html` form so legitimate embedded
+            // images (`data:image/...`) keep working.
+            .replace(/javascript:/gi, '')
+            .replace(/vbscript:/gi, '')
+            .replace(/data:\s*text\/html/gi, '');
+    } while (out !== prev);
+    return out;
 }
 
 /**
diff --git a/public/files/perm/idevices/base/three-sixty-viewer/edition/three-sixty-viewer.js b/public/files/perm/idevices/base/three-sixty-viewer/edition/three-sixty-viewer.js
index b3d49a6d6b..5c899cfe0f 100644
--- a/public/files/perm/idevices/base/three-sixty-viewer/edition/three-sixty-viewer.js
+++ b/public/files/perm/idevices/base/three-sixty-viewer/edition/three-sixty-viewer.js
@@ -1042,9 +1042,13 @@ var $exeDevice = {
         var parts = path.split('.');
         var t = target;
         for (var i = 0; i < parts.length - 1; i++) {
-            t = t[parts[i]];
+            var key = parts[i];
+            if (key === '__proto__' || key === 'prototype' || key === 'constructor') return;
+            t = t[key];
         }
-        t[parts[parts.length - 1]] = value;
+        var lastKey = parts[parts.length - 1];
+        if (lastKey === '__proto__' || lastKey === 'prototype' || lastKey === 'constructor') return;
+        t[lastKey] = value;
     },
 
     escapeHtml: str =>
diff --git a/public/files/perm/idevices/base/three-sixty-viewer/edition/three-sixty-viewer.test.js b/public/files/perm/idevices/base/three-sixty-viewer/edition/three-sixty-viewer.test.js
index 7761148599..981f9add96 100644
--- a/public/files/perm/idevices/base/three-sixty-viewer/edition/three-sixty-viewer.test.js
+++ b/public/files/perm/idevices/base/three-sixty-viewer/edition/three-sixty-viewer.test.js
@@ -1063,4 +1063,32 @@ describe('three-sixty-viewer iDevice (edition)', () => {
             });
         });
     });
+
+    describe('setNestedPath (prototype pollution safety)', () => {
+        it('assigns a nested value for a legitimate dotted path', () => {
+            const target = { initialView: { yaw: 0, pitch: 0, fov: 75 } };
+            $exeDevice.setNestedPath(target, 'initialView.yaw', 90);
+            expect(target.initialView.yaw).toBe(90);
+        });
+
+        it('assigns a top-level key for a single-segment path', () => {
+            const target = { src: '' };
+            $exeDevice.setNestedPath(target, 'src', 'asset://pano.jpg');
+            expect(target.src).toBe('asset://pano.jpg');
+        });
+
+        it('does not pollute Object.prototype via a __proto__ payload', () => {
+            const payload = JSON.parse('{"__proto__":{"polluted":1}}');
+            $exeDevice.setNestedPath({}, '__proto__.polluted', payload.__proto__.polluted);
+            expect({}.polluted).toBeUndefined();
+            expect(Object.prototype.polluted).toBeUndefined();
+        });
+
+        it('ignores assignments through constructor / prototype keys', () => {
+            $exeDevice.setNestedPath({}, 'constructor.prototype.polluted', 1);
+            $exeDevice.setNestedPath({}, 'prototype.polluted', 1);
+            expect({}.polluted).toBeUndefined();
+            expect(Object.prototype.polluted).toBeUndefined();
+        });
+    });
 });
diff --git a/public/files/perm/idevices/base/trivial/edition/trivial.js b/public/files/perm/idevices/base/trivial/edition/trivial.js
index 8b74314a5e..6640da5b42 100644
--- a/public/files/perm/idevices/base/trivial/edition/trivial.js
+++ b/public/files/perm/idevices/base/trivial/edition/trivial.js
@@ -3113,6 +3113,24 @@ var $exeDevice = {
         return valids > 0 ? $exeDevice.selectsGame : false;
     },
 
+    /**
+     * Strip HTML tags from a string.
+     * Applies the tag-removal regex repeatedly until the string stops
+     * changing, so that obfuscated/nested payloads (e.g. "<scr<b>ipt>")
+     * cannot reconstitute a tag after a single pass.
+     * @param {string} text
+     * @returns {string}
+     */
+    stripHtmlTags: function (text) {
+        let result = String(text == null ? '' : text);
+        let previous;
+        do {
+            previous = result;
+            result = result.replace(/<[^>]*>/g, '');
+        } while (result !== previous);
+        return result;
+    },
+
     importGlosary: function (xmlText) {
         const parser = new DOMParser(),
             xmlDoc = parser.parseFromString(xmlText, 'text/xml'),
@@ -3128,10 +3146,9 @@ var $exeDevice = {
         $entries.find('ENTRY').each(function () {
             var $this = $(this),
                 concept = $this.find('CONCEPT').text(),
-                definition = $this
-                    .find('DEFINITION')
-                    .text()
-                    .replace(/<[^>]*>/g, ''); // Elimina HTML
+                definition = $exeDevice.stripHtmlTags(
+                    $this.find('DEFINITION').text()
+                ); // Elimina HTML
             if (concept && definition) {
                 questionsJson.push({
                     solution: concept,
diff --git a/public/files/perm/idevices/base/trivial/edition/trivial.test.js b/public/files/perm/idevices/base/trivial/edition/trivial.test.js
new file mode 100644
index 0000000000..f0e6d95683
--- /dev/null
+++ b/public/files/perm/idevices/base/trivial/edition/trivial.test.js
@@ -0,0 +1,74 @@
+/**
+ * Unit tests for trivial iDevice (edition code)
+ *
+ * Focused on stripHtmlTags, the HTML-tag sanitizer used when importing
+ * glossary entries. It must remove tags even from obfuscated/nested
+ * payloads that would survive a single-pass strip.
+ */
+
+/* eslint-disable no-undef */
+import { readFileSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+/**
+ * Helper to load iDevice file and expose $exeDevice globally.
+ * Replaces 'var $exeDevice' with 'global.$exeDevice' to make it accessible.
+ */
+function loadIdevice(code) {
+  const modifiedCode = code.replace(/var\s+\$exeDevice\s*=/, 'global.$exeDevice =');
+  // eslint-disable-next-line no-eval
+  (0, eval)(modifiedCode);
+  return global.$exeDevice;
+}
+
+describe('trivial iDevice (edition)', () => {
+  let $exeDevice;
+
+  beforeEach(() => {
+    global.$exeDevice = undefined;
+    const filePath = join(__dirname, 'trivial.js');
+    const code = readFileSync(filePath, 'utf-8');
+    $exeDevice = loadIdevice(code);
+  });
+
+  describe('stripHtmlTags', () => {
+    it('exists as a function', () => {
+      expect(typeof $exeDevice.stripHtmlTags).toBe('function');
+    });
+
+    it('removes simple HTML tags but keeps text content', () => {
+      expect($exeDevice.stripHtmlTags('<b>hello</b>')).toBe('hello');
+      expect($exeDevice.stripHtmlTags('a <i>b</i> c')).toBe('a b c');
+    });
+
+    it('preserves plain text without tags unchanged', () => {
+      expect($exeDevice.stripHtmlTags('plain definition')).toBe('plain definition');
+    });
+
+    it('strips a nested/obfuscated script payload leaving no script tag', () => {
+      const payload = '<scr<script>ipt>alert(1)</script>';
+      const out = $exeDevice.stripHtmlTags(payload);
+      // No reconstituted <script tag should survive (case-insensitive),
+      // and the result is stable (a second strip would not change it).
+      expect(out.toLowerCase()).not.toContain('<script');
+      expect(out).toBe($exeDevice.stripHtmlTags(out));
+    });
+
+    it('reaches a fixed point: re-stripping the output never changes it', () => {
+      const samples = ['<<a>b>x', '<a><b', '<scr<a>ipt>', '<<script>>'];
+      for (const sample of samples) {
+        const once = $exeDevice.stripHtmlTags(sample);
+        expect($exeDevice.stripHtmlTags(once)).toBe(once);
+      }
+    });
+
+    it('handles null/undefined by returning an empty string', () => {
+      expect($exeDevice.stripHtmlTags(null)).toBe('');
+      expect($exeDevice.stripHtmlTags(undefined)).toBe('');
+    });
+  });
+});
diff --git a/public/files/perm/idevices/base/udl-content/edition/udl-content.js b/public/files/perm/idevices/base/udl-content/edition/udl-content.js
index e3cbc0941d..d595f8ed47 100644
--- a/public/files/perm/idevices/base/udl-content/edition/udl-content.js
+++ b/public/files/perm/idevices/base/udl-content/edition/udl-content.js
@@ -238,7 +238,7 @@ var $exeDevice = {
         // Delete block
         e.unbind('click').click(function () {
             var msg = _("Delete block $? This can't be undone.");
-            msg = msg.replace('$', i + 1);
+            msg = msg.replace(/\$/g, i + 1);
             eXe.app.confirm(_('Attention'), msg, function () {
                 // Update the data
                 var data = $exeDevice.formToJSON();
@@ -334,9 +334,12 @@ var $exeDevice = {
         fid = fid.replace('Options-', 'Explanation-');
         optionsBlock = $('#' + fid);
         if (e.value != '' && e.value.indexOf('|') != -1) {
-            var tmp = e.value;
-            tmp = tmp.replace('|', '~~');
-            var parts = tmp.split('~~');
+            // Split on the first "|" only: hidden screen-reader text | visible label
+            var pipeIdx = e.value.indexOf('|');
+            var parts = [
+                e.value.slice(0, pipeIdx),
+                e.value.slice(pipeIdx + 1),
+            ];
             if (parts.length == 2) {
                 if (parts[0] != '' && parts[1] != '') {
                     var spans = $('span', optionsBlock);
@@ -559,9 +562,9 @@ var $exeDevice = {
         var txtA = '';
         var txtB = '';
         if (btnTxt.indexOf('|') != -1) {
-            var tmp = btnTxt;
-            tmp = tmp.replace('|', '~~');
-            var parts = tmp.split('~~');
+            // Split on the first "|" only: hidden screen-reader text | visible label
+            var pipeIdx = btnTxt.indexOf('|');
+            var parts = [btnTxt.slice(0, pipeIdx), btnTxt.slice(pipeIdx + 1)];
             if (parts.length == 2) {
                 if (parts[0] != '' && parts[1] != '') {
                     btnTextPartsStyle = '';
@@ -862,8 +865,12 @@ var $exeDevice = {
                 btnTxt = $.trim(btnTxt);
                 // Check if the button text has accessible hidden content
                 if (btnTxt.indexOf('|') != -1) {
-                    var tmp = btnTxt.replace('|', '~~');
-                    var parts = tmp.split('~~');
+                    // Split on the first "|" only: hidden screen-reader text | visible label
+                    var pipeIdx = btnTxt.indexOf('|');
+                    var parts = [
+                        btnTxt.slice(0, pipeIdx),
+                        btnTxt.slice(pipeIdx + 1),
+                    ];
                     if (parts.length == 2) {
                         if (parts[0] != '' && parts[1] != '') {
                             btnTxt =
diff --git a/public/files/perm/idevices/base/udl-content/edition/udl-content.test.js b/public/files/perm/idevices/base/udl-content/edition/udl-content.test.js
new file mode 100644
index 0000000000..6ea7890697
--- /dev/null
+++ b/public/files/perm/idevices/base/udl-content/edition/udl-content.test.js
@@ -0,0 +1,113 @@
+/**
+ * Unit tests for udl-content iDevice (edition code).
+ *
+ * Focus: the "accessible hidden text | visible label" parsing that splits the
+ * button text on the FIRST "|" only. These tests pin the security-relevant
+ * behavior of the split (CodeQL incomplete-sanitization fixes) and guard
+ * against regressions for legitimate inputs whose visible label contains
+ * additional "|" characters.
+ */
+
+/* eslint-disable no-undef */
+import { readFileSync } from 'fs';
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+import { beforeEach, describe, expect, it } from 'vitest';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+/**
+ * Helper to load the iDevice file and expose $exeDevice globally.
+ * Replaces 'var $exeDevice' with 'global.$exeDevice' to make it accessible.
+ */
+function loadIdevice(code) {
+    const modifiedCode = code.replace(/var\s+\$exeDevice\s*=/, 'global.$exeDevice =');
+    // eslint-disable-next-line no-eval
+    (0, eval)(modifiedCode);
+    return global.$exeDevice;
+}
+
+describe('udl-content iDevice (edition)', () => {
+    let $exeDevice;
+    let appended;
+
+    beforeEach(() => {
+        // i18n helpers are invoked eagerly while building the object literal.
+        global._ = (s) => s;
+        global.c_ = (s) => s;
+
+        // createBlockForm() touches the DOM through a tiny set of jQuery
+        // calls. Provide a chainable no-op stub; only .append() captures the
+        // generated HTML so the split logic can be asserted.
+        appended = '';
+        const makeJq = () => {
+            const node = {
+                append: (html) => {
+                    appended += html;
+                    return node;
+                },
+            };
+            const passthrough = ['hide', 'show', 'html', 'addClass', 'removeClass'];
+            for (const m of passthrough) node[m] = () => node;
+            return node;
+        };
+        global.$ = () => makeJq();
+
+        global.$exeDevice = undefined;
+
+        const filePath = join(__dirname, 'udl-content.js');
+        const code = readFileSync(filePath, 'utf-8');
+        $exeDevice = loadIdevice(code);
+        $exeDevice.idevicePath = '/idevice/';
+    });
+
+    /** Build the block HTML and return what createBlockForm appended. */
+    function renderBlock(btnTxt) {
+        appended = '';
+        $exeDevice.createBlockForm({
+            btnTxt,
+            btnType: 0,
+            contMain: '',
+            contAlt1: '',
+            contAlt2: '',
+            contAlt3: '',
+        });
+        return appended;
+    }
+
+    describe('createBlockForm — split on first "|"', () => {
+        it('splits "hidden | visible" into the two accessibility spans', () => {
+            const html = renderBlock('hidden | visible');
+            // Accessible-hidden part (before the first "|").
+            expect(html).toContain('class="sr-only-explanation"');
+            expect(html).toContain('>hidden </span>');
+            // Visible part (after the first "|").
+            expect(html).toContain('> visible</span>');
+        });
+
+        it('keeps every "|" after the first one in the visible label (no global replace)', () => {
+            // Legitimate input: the visible label itself contains pipe characters.
+            const html = renderBlock('hidden|a|b|c');
+            // Everything after the FIRST pipe stays intact, including later pipes.
+            expect(html).toContain('>hidden</span>');
+            expect(html).toContain('>a|b|c</span>');
+        });
+
+        it('parses purely on the first "|" without a tilde sentinel collision', () => {
+            // Older code used "~~" as an intermediate sentinel; the new split is
+            // sentinel-free, so input is parsed purely on the first "|".
+            const html = renderBlock('left | right side');
+            expect(html).toContain('>left </span>');
+            expect(html).toContain('> right side</span>');
+        });
+
+        it('leaves the explanation block hidden when there is no "|"', () => {
+            const html = renderBlock('plain label');
+            // btnTextPartsStyle stays display:none (no accessible-hidden parts).
+            expect(html).toContain(
+                'udlContentFormBlockButtonTxtExplanation" style="display:none"',
+            );
+        });
+    });
+});
diff --git a/public/files/perm/idevices/base/word-search/edition/word-search.js b/public/files/perm/idevices/base/word-search/edition/word-search.js
index ef4f35a7da..4faea956cb 100644
--- a/public/files/perm/idevices/base/word-search/edition/word-search.js
+++ b/public/files/perm/idevices/base/word-search/edition/word-search.js
@@ -196,11 +196,17 @@ var $exeDevice = {
 
         const words = [];
         $entries.find('ENTRY').each(function () {
-            const concept = $(this).find('CONCEPT').text(),
-                definition = $(this)
-                    .find('DEFINITION')
-                    .text()
-                    .replace(/<[^>]*>/g, '');
+            const concept = $(this).find('CONCEPT').text();
+            // Strip HTML tags. Apply the replacement repeatedly until the
+            // string stops changing so nested/obfuscated payloads such as
+            // "<scr<script>ipt>" cannot reassemble into a new tag after a
+            // single pass.
+            let definition = $(this).find('DEFINITION').text();
+            let previousDefinition;
+            do {
+                previousDefinition = definition;
+                definition = definition.replace(/<[^>]*>/g, '');
+            } while (definition !== previousDefinition);
             if (
                 concept &&
                 definition &&
diff --git a/public/files/perm/idevices/base/word-search/edition/word-search.test.js b/public/files/perm/idevices/base/word-search/edition/word-search.test.js
new file mode 100644
index 0000000000..897d72bc7b
--- /dev/null
+++ b/public/files/perm/idevices/base/word-search/edition/word-search.test.js
@@ -0,0 +1,116 @@
+/**
+ * Unit tests for word-search iDevice (edition)
+ *
+ * Focused on importGlosary HTML-tag sanitization of the DEFINITION field.
+ * The strip must be applied to a fixed point so nested/obfuscated payloads
+ * such as "<scr<script>ipt>" cannot reassemble into a tag after one pass
+ * (CodeQL: incomplete-multi-character-sanitization).
+ */
+
+/* eslint-disable no-undef */
+import { fileURLToPath } from 'url';
+import { dirname, join } from 'path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+describe('word-search iDevice (edition)', () => {
+    let $exeDevice;
+
+    beforeEach(() => {
+        global.$exeDevice = undefined;
+        $exeDevice = global.loadIdevice(join(__dirname, 'word-search.js'));
+    });
+
+    /**
+     * Build a Moodle glossary XML string with a single ENTRY whose CONCEPT
+     * is a short single word (so it passes the import filter) and whose
+     * DEFINITION carries the supplied (possibly malicious) markup.
+     */
+    function glossaryXml(concept, definition) {
+        // Moodle glossary exports store HTML inside DEFINITION as XML-escaped
+        // entities. Escaping here reproduces that: the markup survives XML
+        // parsing and jQuery's .text() decodes it back to the literal tags,
+        // which the importer must then strip.
+        const escaped = definition
+            .replace(/&/g, '&amp;')
+            .replace(/</g, '&lt;')
+            .replace(/>/g, '&gt;');
+        return `<?xml version="1.0" encoding="UTF-8"?>
+            <GLOSSARY>
+                <INFO>
+                    <ENTRIES>
+                        <ENTRY>
+                            <CONCEPT>${concept}</CONCEPT>
+                            <DEFINITION>${escaped}</DEFINITION>
+                        </ENTRY>
+                    </ENTRIES>
+                </INFO>
+            </GLOSSARY>`;
+    }
+
+    it('exposes importGlosary as a function', () => {
+        expect(typeof $exeDevice.importGlosary).toBe('function');
+    });
+
+    it('strips simple HTML tags from the definition', () => {
+        let captured = null;
+        $exeDevice.addWords = (words) => {
+            captured = words;
+        };
+
+        $exeDevice.importGlosary(glossaryXml('term', '<b>hello</b> world'));
+
+        expect(captured).toHaveLength(1);
+        expect(captured[0].word).toBe('term');
+        expect(captured[0].definition).toBe('hello world');
+    });
+
+    it('removes nested/obfuscated tags so no tag survives a single pass', () => {
+        let captured = null;
+        $exeDevice.addWords = (words) => {
+            captured = words;
+        };
+
+        // After one naive pass this leaves "<script>alert(1)</script>".
+        // The fixed-point loop must keep stripping until nothing remains.
+        const payload = '<scr<script>ipt>alert(1)</script>safe';
+        $exeDevice.importGlosary(glossaryXml('term', payload));
+
+        expect(captured).toHaveLength(1);
+        const definition = captured[0].definition;
+        // The security property: no opening tag delimiter survives, so the
+        // reassembled "<script" payload is gone. (A stray ">" left as text
+        // content is inert and not a tag.)
+        expect(definition.toLowerCase()).not.toContain('<script');
+        expect(definition).not.toContain('<');
+        expect(definition).toContain('safe');
+    });
+
+    it('loops to a fixed point when removal reassembles a new tag', () => {
+        let captured = null;
+        $exeDevice.addWords = (words) => {
+            captured = words;
+        };
+
+        // A naive single pass on "<<script>script>" removes "<script>" and
+        // leaves "<script>" behind. The fixed-point loop must strip it too.
+        $exeDevice.importGlosary(glossaryXml('term', '<<script>script>keep'));
+
+        expect(captured).toHaveLength(1);
+        expect(captured[0].definition.toLowerCase()).not.toContain('<script');
+        expect(captured[0].definition).toContain('keep');
+    });
+
+    it('preserves plain-text definitions unchanged', () => {
+        let captured = null;
+        $exeDevice.addWords = (words) => {
+            captured = words;
+        };
+
+        $exeDevice.importGlosary(glossaryXml('term', 'just plain text'));
+
+        expect(captured).toHaveLength(1);
+        expect(captured[0].definition).toBe('just plain text');
+    });
+});
diff --git a/scripts/static-bundle/static-index.html b/scripts/static-bundle/static-index.html
index 44fd8fd730..e1ce22bf06 100644
--- a/scripts/static-bundle/static-index.html
+++ b/scripts/static-bundle/static-index.html
@@ -111,17 +111,11 @@
             if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {
                 return crypto.randomUUID();
             }
-            // Fallback using crypto.getRandomValues (works in all contexts)
-            if (typeof crypto !== 'undefined' && typeof crypto.getRandomValues === 'function') {
-                return ([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g, c =>
-                    (c ^ crypto.getRandomValues(new Uint8Array(1))[0] & 15 >> c / 4).toString(16)
-                );
-            }
-            // Last resort fallback using Math.random (not cryptographically secure)
-            return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, c => {
-                const r = Math.random() * 16 | 0;
-                return (c === 'x' ? r : (r & 0x3 | 0x8)).toString(16);
-            });
+            // Fallback using crypto.getRandomValues (works in all contexts,
+            // including non-secure HTTP origins where randomUUID is unavailable)
+            return ([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g, c =>
+                (c ^ crypto.getRandomValues(new Uint8Array(1))[0] & 15 >> c / 4).toString(16)
+            );
         }
 
         window.eXeLearning = {
diff --git a/src/cli/commands/translations.spec.ts b/src/cli/commands/translations.spec.ts
index f29c27f1d3..5f8d21f1fe 100644
--- a/src/cli/commands/translations.spec.ts
+++ b/src/cli/commands/translations.spec.ts
@@ -951,4 +951,32 @@ describe('Translations Command', () => {
             expect(content).not.toMatch(/resname="key"/);
         });
     });
+
+    describe('unescapeXml', () => {
+        it('should not double-decode escaped entities (security: &amp; decoded last)', async () => {
+            const { unescapeXml } = await import('./translations');
+            // The literal text "&lt;" is encoded as "&amp;lt;". Decoding must yield
+            // the literal "&lt;", NOT collapse into "<".
+            expect(unescapeXml('&amp;lt;')).toBe('&lt;');
+            // The literal text "&amp;" is encoded as "&amp;amp;". Decoding must yield
+            // the literal "&amp;", NOT collapse into "&".
+            expect(unescapeXml('&amp;amp;')).toBe('&amp;');
+        });
+
+        it('should decode all standard XML entities for legitimate input', async () => {
+            const { unescapeXml } = await import('./translations');
+            expect(unescapeXml('&lt;')).toBe('<');
+            expect(unescapeXml('&gt;')).toBe('>');
+            expect(unescapeXml('&quot;')).toBe('"');
+            expect(unescapeXml('&apos;')).toBe("'");
+            expect(unescapeXml('&amp;')).toBe('&');
+            expect(unescapeXml('Tom &amp; Jerry &lt;tag&gt;')).toBe('Tom & Jerry <tag>');
+        });
+
+        it('should round-trip escapeXml then unescapeXml', async () => {
+            const { escapeXml, unescapeXml } = await import('./translations');
+            const original = `a < b & c > d "e" 'f'`;
+            expect(unescapeXml(escapeXml(original))).toBe(original);
+        });
+    });
 });
diff --git a/src/cli/commands/translations.ts b/src/cli/commands/translations.ts
index 20422c3ee6..5527d6701c 100644
--- a/src/cli/commands/translations.ts
+++ b/src/cli/commands/translations.ts
@@ -277,11 +277,11 @@ function escapeXmlText(str: string): string {
  */
 export function unescapeXml(str: string): string {
     return str
-        .replace(/&amp;/g, '&')
         .replace(/&lt;/g, '<')
         .replace(/&gt;/g, '>')
         .replace(/&quot;/g, '"')
-        .replace(/&apos;/g, "'");
+        .replace(/&apos;/g, "'")
+        .replace(/&amp;/g, '&');
 }
 
 /**
diff --git a/src/cli/commands/update-licenses.spec.ts b/src/cli/commands/update-licenses.spec.ts
index ba209c8d37..037dcacfb1 100644
--- a/src/cli/commands/update-licenses.spec.ts
+++ b/src/cli/commands/update-licenses.spec.ts
@@ -102,6 +102,24 @@ describe('Update Licenses Command', () => {
             const content = 'MIT License\n\nPermission is hereby granted...';
             expect(extractCopyrightFromLicense(content)).toBeNull();
         });
+
+        it('should strip a <script> payload to a fixed point leaving no tag behind', () => {
+            // Security property for incomplete-multi-character-sanitization:
+            // the angle-bracket strip is applied repeatedly to a fixed point, so
+            // no complete "<...>" tag (e.g. "<script") survives in the result.
+            const content = 'Copyright (c) 2023 Acme <script>x</script> Inc';
+            const result = extractCopyrightFromLicense(content);
+            expect(result).not.toContain('<');
+            expect(result?.toLowerCase()).not.toContain('<script');
+            expect(result).toBe('Acme x Inc');
+        });
+
+        it('should strip multiple bracketed and parenthetical segments to a fixed point', () => {
+            const content = 'Copyright (c) 2023 Acme <a><b> Inc';
+            expect(extractCopyrightFromLicense(content)).toBe('Acme Inc');
+            const parens = 'Copyright (c) 2023 Acme (legacy) (note) Inc';
+            expect(extractCopyrightFromLicense(parens)).toBe('Acme Inc');
+        });
     });
 
     describe('getPackageInfo', () => {
diff --git a/src/cli/commands/update-licenses.ts b/src/cli/commands/update-licenses.ts
index 59e2c57169..433ba221b4 100644
--- a/src/cli/commands/update-licenses.ts
+++ b/src/cli/commands/update-licenses.ts
@@ -121,10 +121,18 @@ export function extractCopyrightFromLicense(content: string): string | null {
             // Get first line only
             let author = match[1].split('\n')[0];
             // Clean up the result - remove "All rights reserved", email, etc.
+            // Apply the strip passes repeatedly to a fixed point: removing one
+            // <...> or (...) match can splice two halves into a brand-new match
+            // (e.g. "<a<b>c>"), so a single pass is insufficient.
+            let prev: string;
+            do {
+                prev = author;
+                author = author
+                    .replace(/all rights reserved\.?/gi, '')
+                    .replace(/<[^>]+>/g, '') // Remove emails in <brackets>
+                    .replace(/\s*\([^)]*\)/g, ''); // Remove parenthetical notes
+            } while (author !== prev);
             author = author
-                .replace(/all rights reserved\.?/gi, '')
-                .replace(/<[^>]+>/g, '') // Remove emails in <brackets>
-                .replace(/\s*\([^)]*\)/g, '') // Remove parenthetical notes
                 .replace(/\s+/g, ' ') // Normalize whitespace
                 .trim();
             // Remove trailing punctuation
diff --git a/src/routes/project.spec.ts b/src/routes/project.spec.ts
index 7e313363d9..64d1bdd3a4 100644
--- a/src/routes/project.spec.ts
+++ b/src/routes/project.spec.ts
@@ -11,6 +11,7 @@ import {
     createProjectRoutes,
     createSymfonyCompatProjectRoutes,
     buildDefaultThemePayload,
+    isUnsafeLinkScheme,
     type ProjectDependencies,
     type SessionManagerDeps,
     type FileHelperDeps,
@@ -1856,7 +1857,7 @@ describe('Project Routes', () => {
             expect(body.brokenLinks[0].brokenLinks).toBe('No broken links found');
         });
 
-        it('should skip javascript and data URLs', async () => {
+        it('should skip javascript, vbscript and data URLs (case-insensitive, padded)', async () => {
             const res = await app.handle(
                 new Request('http://localhost/api/ode-management/odes/session/brokenlinks', {
                     method: 'POST',
@@ -1864,7 +1865,14 @@ describe('Project Routes', () => {
                     body: JSON.stringify({
                         idevices: [
                             {
-                                html: '<a href="javascript:void(0)">JS Link</a><img src="data:image/png;base64,abc">',
+                                html:
+                                    '<a href="javascript:void(0)">JS Link</a>' +
+                                    '<a href="JavaScript:void(0)">Mixed JS</a>' +
+                                    '<a href=" javascript:void(0)">Padded JS</a>' +
+                                    '<a href="vbscript:msgbox(1)">VBScript</a>' +
+                                    '<a href="VBScript:msgbox(1)">Mixed VBScript</a>' +
+                                    '<img src="data:image/png;base64,abc">' +
+                                    '<img src="DATA:text/html,<script>alert(1)</script>">',
                             },
                         ],
                     }),
@@ -1873,10 +1881,54 @@ describe('Project Routes', () => {
 
             expect(res.status).toBe(200);
             const body = await res.json();
+            // Every dangerous-scheme link is filtered out, so nothing is reported.
             expect(body.brokenLinks[0].brokenLinks).toBe('No broken links found');
         });
     });
 
+    describe('isUnsafeLinkScheme', () => {
+        it('treats script-capable schemes as unsafe', () => {
+            expect(isUnsafeLinkScheme('javascript:void(0)')).toBe(true);
+            expect(isUnsafeLinkScheme('vbscript:msgbox(1)')).toBe(true);
+            expect(isUnsafeLinkScheme('data:text/html,<script>alert(1)</script>')).toBe(true);
+        });
+
+        it('is case-insensitive', () => {
+            expect(isUnsafeLinkScheme('JavaScript:void(0)')).toBe(true);
+            expect(isUnsafeLinkScheme('VBScript:msgbox(1)')).toBe(true);
+            expect(isUnsafeLinkScheme('DATA:text/html,x')).toBe(true);
+        });
+
+        it('tolerates leading whitespace and control characters', () => {
+            expect(isUnsafeLinkScheme(' javascript:alert(1)')).toBe(true);
+            expect(isUnsafeLinkScheme('\t\njavascript:alert(1)')).toBe(true);
+            expect(isUnsafeLinkScheme(' vbscript:msgbox(1)')).toBe(true);
+            expect(isUnsafeLinkScheme(' \tdata:text/html,x')).toBe(true);
+            // Leading NUL (U+0000) and US (U+001F) control-char padding that
+            // URL parsers strip before resolving the scheme.
+            const nul = String.fromCharCode(0);
+            const us = String.fromCharCode(0x1f);
+            expect(isUnsafeLinkScheme(`${nul}javascript:alert(1)`)).toBe(true);
+            expect(isUnsafeLinkScheme(`${us}vbscript:msgbox(1)`)).toBe(true);
+            expect(isUnsafeLinkScheme(`${nul}${us} data:text/html,x`)).toBe(true);
+        });
+
+        it('keeps legitimate links safe', () => {
+            expect(isUnsafeLinkScheme('http://example.com')).toBe(false);
+            expect(isUnsafeLinkScheme('https://example.com/page')).toBe(false);
+            expect(isUnsafeLinkScheme('//cdn.example.com/a.js')).toBe(false);
+            expect(isUnsafeLinkScheme('mailto:user@example.com')).toBe(false);
+            expect(isUnsafeLinkScheme('tel:+34123456789')).toBe(false);
+            expect(isUnsafeLinkScheme('files/img/photo.png')).toBe(false);
+            expect(isUnsafeLinkScheme('exe-node:abc')).toBe(false);
+            expect(isUnsafeLinkScheme('#anchor')).toBe(false);
+            expect(isUnsafeLinkScheme('relative/path.html')).toBe(false);
+            expect(isUnsafeLinkScheme('')).toBe(false);
+            // Substrings of dangerous schemes must not trip the prefix check.
+            expect(isUnsafeLinkScheme('https://x/javascript:notscheme')).toBe(false);
+        });
+    });
+
     describe('Link Extraction (brokenlinks/extract)', () => {
         it('should extract links without validating', async () => {
             const res = await app.handle(
diff --git a/src/routes/project.ts b/src/routes/project.ts
index 9de7825253..a3b0ec8164 100644
--- a/src/routes/project.ts
+++ b/src/routes/project.ts
@@ -92,6 +92,29 @@ export async function resolveDefaultThemeForNewProject(
     }
     return themeDirName;
 }
+
+/**
+ * Returns true when a link URL uses a scheme that can execute script when
+ * navigated/rendered (e.g. `javascript:`, `vbscript:`, `data:`) and must
+ * therefore be discarded by the broken-link checker.
+ *
+ * The check is deliberately defensive: schemes are matched case-insensitively
+ * and after stripping leading whitespace and C0 control characters, which
+ * browsers ignore when resolving a URL. This prevents bypasses such as
+ * `VBScript:...`, a leading-space `" javascript:..."`, or control-character
+ * padding from slipping a dangerous scheme past the filter.
+ *
+ * Exported so the security property can be unit-tested directly.
+ */
+export function isUnsafeLinkScheme(url: string): boolean {
+    if (!url) return false;
+    // Strip leading whitespace and C0 control chars that URL parsers ignore,
+    // so padded schemes (e.g. a leading-space javascript:) cannot bypass the check.
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: intentionally matching the C0 control chars browsers ignore in URLs
+    const normalized = url.replace(/^[\s\u0000-\u001f]+/, '').toLowerCase();
+    return normalized.startsWith('javascript:') || normalized.startsWith('vbscript:') || normalized.startsWith('data:');
+}
+
 import { getAppVersion } from '../utils/version';
 import { buildSiteThemeUrl } from '../utils/site-theme-url';
 import {
@@ -1833,8 +1856,9 @@ export function createSymfonyCompatProjectRoutes(deps: ProjectDependencies = def
                     return links.filter(link => {
                         if (!link.url || link.url.trim() === '') return false;
                         if (link.url.startsWith('#')) return false;
-                        if (link.url.startsWith('javascript:')) return false;
-                        if (link.url.startsWith('data:')) return false;
+                        // Drop URLs whose scheme can execute script (javascript:,
+                        // vbscript:, data:), tolerating case and leading whitespace/controls.
+                        if (isUnsafeLinkScheme(link.url)) return false;
                         return true;
                     });
                 };
diff --git a/src/services/folder-manager.spec.ts b/src/services/folder-manager.spec.ts
index 175107ae67..c840d614a2 100644
--- a/src/services/folder-manager.spec.ts
+++ b/src/services/folder-manager.spec.ts
@@ -141,6 +141,19 @@ describe('Folder Manager Service', () => {
             expect(service.sanitizeFolderName('folder*name')).toBe('folder_name');
         });
 
+        it('should replace ALL invalid characters, not just the first', () => {
+            // Incomplete-sanitization regression guard: without the global flag
+            // only the first invalid character would be replaced, leaving the
+            // rest (e.g. directory separators) intact.
+            expect(service.sanitizeFolderName('a<b>c')).toBe('a_b_c');
+            expect(service.sanitizeFolderName('a/b/c')).toBe('a_b_c');
+            expect(service.sanitizeFolderName('a\\b\\c')).toBe('a_b_c');
+            expect(service.sanitizeFolderName('<>:"|?*')).toBe('_______');
+            // No invalid character should survive sanitization.
+            expect(service.sanitizeFolderName('x:y/z')).not.toContain('/');
+            expect(service.sanitizeFolderName('x:y/z')).not.toContain(':');
+        });
+
         it('should remove leading dots and spaces', () => {
             expect(service.sanitizeFolderName('.hidden')).toBe('hidden');
             expect(service.sanitizeFolderName('  folder')).toBe('folder');
diff --git a/src/services/folder-manager.ts b/src/services/folder-manager.ts
index d7bb7c6b1c..3ea7c49247 100644
--- a/src/services/folder-manager.ts
+++ b/src/services/folder-manager.ts
@@ -113,6 +113,9 @@ export interface FolderManagerService {
 // Invalid characters for folder names (cross-platform safe)
 // Note: we check for control chars (0-31) separately to avoid regex escape issues
 const INVALID_CHARS = /[<>:"|?*\\/]/;
+// Global variant used for sanitization so that ALL invalid characters are
+// replaced, not just the first occurrence (incomplete sanitization fix).
+const INVALID_CHARS_GLOBAL = /[<>:"|?*\\/]/g;
 const RESERVED_NAMES = ['CON', 'PRN', 'AUX', 'NUL', 'COM1', 'COM2', 'COM3', 'COM4', 'LPT1', 'LPT2', 'LPT3', 'LPT4'];
 
 /**
@@ -182,8 +185,8 @@ export function createFolderManagerService(deps: FolderManagerDeps = {}): Folder
     const sanitizeFolderName = (name: string): string => {
         // Remove control characters first
         let sanitized = removeControlChars(name);
-        // Remove invalid characters
-        sanitized = sanitized.replace(INVALID_CHARS, '_');
+        // Remove invalid characters (global: replace every occurrence)
+        sanitized = sanitized.replace(INVALID_CHARS_GLOBAL, '_');
         // Remove leading/trailing dots and spaces
         sanitized = sanitized.replace(/^[.\s]+|[.\s]+$/g, '');
         // Truncate to max length
diff --git a/src/services/link-validator.spec.ts b/src/services/link-validator.spec.ts
index 6322b83140..435e1bfaa4 100644
--- a/src/services/link-validator.spec.ts
+++ b/src/services/link-validator.spec.ts
@@ -115,6 +115,74 @@ describe('Link Validator Service', () => {
             const result = removeInvalidLinks(links);
             expect(result).toHaveLength(0);
         });
+
+        it('should remove vbscript: links', () => {
+            const links: RawExtractedLink[] = [
+                { url: 'vbscript:msgbox("hi")', count: 1 },
+                { url: 'VBScript:Execute("x")', count: 1 },
+            ];
+            const result = removeInvalidLinks(links);
+            expect(result).toHaveLength(0);
+        });
+
+        it('should remove dangerous schemes regardless of case', () => {
+            const links: RawExtractedLink[] = [
+                { url: 'JaVaScRiPt:alert(1)', count: 1 },
+                { url: 'JAVASCRIPT:void(0)', count: 1 },
+                { url: 'DATA:text/html,<h1>Hi</h1>', count: 1 },
+            ];
+            const result = removeInvalidLinks(links);
+            expect(result).toHaveLength(0);
+        });
+
+        it('should remove dangerous schemes with leading whitespace/control chars', () => {
+            const links: RawExtractedLink[] = [
+                { url: ' javascript:alert(1)', count: 1 },
+                { url: '\tjavascript:alert(2)', count: 1 },
+                { url: '\n\rvbscript:msgbox(1)', count: 1 },
+                { url: ' data:text/html,<h1>Hi</h1>', count: 1 },
+            ];
+            const result = removeInvalidLinks(links);
+            expect(result).toHaveLength(0);
+        });
+
+        it('should remove dangerous schemes hidden by embedded control chars', () => {
+            const links: RawExtractedLink[] = [
+                { url: 'java\tscript:alert(1)', count: 1 },
+                { url: 'java\nscript:alert(2)', count: 1 },
+            ];
+            const result = removeInvalidLinks(links);
+            expect(result).toHaveLength(0);
+        });
+
+        it('should remove dangerous schemes obfuscated with HTML entities', () => {
+            const links: RawExtractedLink[] = [
+                { url: 'java&#9;script:alert(1)', count: 1 },
+                { url: 'java&#x0a;script:alert(2)', count: 1 },
+                { url: 'java&Tab;script:alert(3)', count: 1 },
+            ];
+            const result = removeInvalidLinks(links);
+            expect(result).toHaveLength(0);
+        });
+
+        it('should keep legitimate http/https/relative links', () => {
+            const links: RawExtractedLink[] = [
+                { url: 'http://example.com', count: 1 },
+                { url: 'https://example.com/page', count: 1 },
+                { url: 'files/image.png', count: 1 },
+                { url: 'mailto:user@example.com', count: 1 },
+                { url: '//cdn.example.com/lib.js', count: 1 },
+            ];
+            const result = removeInvalidLinks(links);
+            expect(result).toHaveLength(5);
+            expect(result.map(l => l.url)).toEqual([
+                'http://example.com',
+                'https://example.com/page',
+                'files/image.png',
+                'mailto:user@example.com',
+                '//cdn.example.com/lib.js',
+            ]);
+        });
     });
 
     describe('deduplicateLinks', () => {
diff --git a/src/services/link-validator.ts b/src/services/link-validator.ts
index 414bb94ab9..ab798bd1c4 100644
--- a/src/services/link-validator.ts
+++ b/src/services/link-validator.ts
@@ -83,16 +83,41 @@ export function cleanAndCountLinks(links: RawExtractedLink[]): RawExtractedLink[
     return Array.from(urlCounts.entries()).map(([url, count]) => ({ url, count }));
 }
 
+/**
+ * Schemes that can execute script or smuggle markup. These must never be
+ * treated as validatable links, regardless of casing, leading whitespace,
+ * control characters, or HTML-entity obfuscation.
+ */
+const DANGEROUS_URL_SCHEMES = ['javascript:', 'vbscript:', 'data:'];
+
+/**
+ * Normalize a URL for scheme inspection: decode the HTML entities and strip
+ * the leading whitespace / control characters that browsers ignore when
+ * resolving a URL scheme, then lowercase the result. This prevents bypasses
+ * such as " javascript:", "JaVaScRiPt:", or "java&#9;script:".
+ */
+function normalizeUrlForSchemeCheck(url: string): string {
+    return (
+        url
+            // Decode HTML entities for whitespace/control chars (tab, LF, CR).
+            .replace(/&(?:#x0*9|#0*9|#x0*a|#0*10|#x0*d|#0*13|tab|newline);/gi, '')
+            // Strip leading/embedded whitespace and C0 control characters (U+0000-U+0020).
+            // biome-ignore lint/suspicious/noControlCharactersInRegex: intentionally matching the C0 control chars browsers ignore when resolving a URL scheme, to block obfuscated-scheme bypasses.
+            .replace(/[\u0000-\u0020]+/g, '')
+            .toLowerCase()
+    );
+}
+
 /**
  * Remove invalid/non-validatable links
- * Filters out: empty, anchors (#), javascript:, data: URLs
+ * Filters out: empty, anchors (#), and dangerous schemes (javascript:, vbscript:, data:)
  */
 export function removeInvalidLinks(links: RawExtractedLink[]): RawExtractedLink[] {
     return links.filter(link => {
         if (!link.url || link.url.trim() === '') return false;
         if (link.url.startsWith('#')) return false;
-        if (link.url.startsWith('javascript:')) return false;
-        if (link.url.startsWith('data:')) return false;
+        const normalized = normalizeUrlForSchemeCheck(link.url);
+        if (DANGEROUS_URL_SCHEMES.some(scheme => normalized.startsWith(scheme))) return false;
         return true;
     });
 }
diff --git a/src/shared/export/exporters/PrintPreviewExporter.spec.ts b/src/shared/export/exporters/PrintPreviewExporter.spec.ts
index d19c890596..c85c7811e6 100644
--- a/src/shared/export/exporters/PrintPreviewExporter.spec.ts
+++ b/src/shared/export/exporters/PrintPreviewExporter.spec.ts
@@ -704,33 +704,7 @@ describe('PrintPreviewExporter', () => {
             const exp = new PrintPreviewExporter(doc, mockResourceProvider);
             const result = await exp.generatePreview();
 
-            // Helper to check for display: none !important
-            const checkHidden = (snippet: string) => {
-                // Determine the tag type to construct the expectation
-                const isImg = snippet.startsWith('<img');
-                const isA = snippet.startsWith('<a');
-
-                // We expect the style to be injected. The regex might produce slightly different attribute orders
-                // but our tool usually appends/modifies style.
-                // Let's check that the result string contains the content AND display: none
-                // Since result.html is large, we can't easily isolate just this element without parsing.
-                // But we know the content strings are unique enough.
-
-                // Simplified check: Does the HTML contain the unique text/src AND style="...display: none..."?
-                // For images, check src. For text, check text content.
-
-                // Actually, let's just regex match the specific element in the result
-                // We'll escape the snippet for regex and allow for inserted style
-                // This is getting complicated to verify strictly with simple expectation.
-                // Let's rely on finding `style="display: none !important"` near the identifying class/content.
-                expect(result.html).toMatch(
-                    new RegExp(snippet.replace('>', '.*style=.*display:\\s*none.*!important.*>')),
-                );
-            };
-
-            // Can't easily use regex match on exact input string because attributes might move if we parsed them?
-            // If we use string replace, attributes stay mostly put.
-            // Let's check that the specific class combinations now have style="display: none !important" attached.
+            // Check that the specific class combinations now have style="display: none !important" attached.
 
             // 1. Version divs
             expect(result.html).toContain('class="sopa-version js-hidden" style="display: none !important"');
diff --git a/src/shared/export/generators/I18nGenerator.spec.ts b/src/shared/export/generators/I18nGenerator.spec.ts
index 00b2d2ad27..32d2ab843c 100644
--- a/src/shared/export/generators/I18nGenerator.spec.ts
+++ b/src/shared/export/generators/I18nGenerator.spec.ts
@@ -80,6 +80,20 @@ describe('parseXlfTranslations', () => {
         expect(map.get('Entities & test')).toBe('Entidades & prueba');
     });
 
+    it('should not double-decode escaped entities (&amp;lt; stays &lt;, &amp;amp; stays &amp;)', () => {
+        // Security: decoding &amp; -> & must happen LAST so that the literal text
+        // "&lt;" (written in XML as "&amp;lt;") does not wrongly collapse to "<".
+        const xlf = `<xliff>
+  <body>
+    <trans-unit id="1"><source>literal lt</source><target>&amp;lt;</target></trans-unit>
+    <trans-unit id="2"><source>literal amp</source><target>&amp;amp;</target></trans-unit>
+  </body>
+</xliff>`;
+        const map = parseXlfTranslations(xlf);
+        expect(map.get('literal lt')).toBe('&lt;');
+        expect(map.get('literal amp')).toBe('&amp;');
+    });
+
     it('should return an empty Map for an empty XLF string', () => {
         const map = parseXlfTranslations('');
         expect(map.size).toBe(0);
diff --git a/src/shared/export/generators/I18nGenerator.ts b/src/shared/export/generators/I18nGenerator.ts
index 0a70f67328..8d639b517d 100644
--- a/src/shared/export/generators/I18nGenerator.ts
+++ b/src/shared/export/generators/I18nGenerator.ts
@@ -17,13 +17,13 @@
  */
 function decodeXmlEntities(str: string): string {
     return str
-        .replace(/&amp;/g, '&')
         .replace(/&lt;/g, '<')
         .replace(/&gt;/g, '>')
         .replace(/&quot;/g, '"')
         .replace(/&apos;/g, "'")
         .replace(/&#(\d+);/g, (_, num) => String.fromCharCode(parseInt(num, 10)))
-        .replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)));
+        .replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
+        .replace(/&amp;/g, '&');
 }
 
 /**
diff --git a/src/shared/export/prerender/ServerLatexPreRenderer.spec.ts b/src/shared/export/prerender/ServerLatexPreRenderer.spec.ts
index 399ab9f2ac..fbffe8d417 100644
--- a/src/shared/export/prerender/ServerLatexPreRenderer.spec.ts
+++ b/src/shared/export/prerender/ServerLatexPreRenderer.spec.ts
@@ -3,7 +3,7 @@
  */
 
 import { describe, it, expect, beforeAll } from 'bun:test';
-import { ServerLatexPreRenderer } from './ServerLatexPreRenderer';
+import { ServerLatexPreRenderer, cleanLatexFromHtml } from './ServerLatexPreRenderer';
 
 describe('ServerLatexPreRenderer', () => {
     let renderer: ServerLatexPreRenderer;
@@ -281,6 +281,44 @@ describe('ServerLatexPreRenderer', () => {
         });
     });
 
+    describe('cleanLatexFromHtml', () => {
+        it('should strip nested/obfuscated tags without leaving a reassembled tag', () => {
+            // A naive single pass on this payload removes the inner tag and splices
+            // the halves into a NEW "<script>" tag. The fixed-point loop must keep
+            // stripping until no "<tag>" remains.
+            const clean = cleanLatexFromHtml('<scr<script>ipt>alert(1)</scr<script>ipt>');
+            expect(clean.toLowerCase()).not.toContain('<script');
+            // No opening tag "<...>" may survive anywhere in the output.
+            expect(/<[^>]+>/.test(clean)).toBe(false);
+            expect(clean).toContain('alert(1)');
+        });
+
+        it('should strip plain HTML tags but keep LaTeX content', () => {
+            expect(cleanLatexFromHtml('<b>\\(x^2\\)</b>')).toBe('\\(x^2\\)');
+        });
+
+        it('should convert <br> tags to newlines', () => {
+            expect(cleanLatexFromHtml('a<br>b<br/>c')).toBe('a\nb\nc');
+        });
+
+        it('should decode double-escaped entity text literally (no over-decoding)', () => {
+            // "&amp;lt;" is the literal text "&lt;" and must stay "&lt;",
+            // not be over-decoded into "<".
+            expect(cleanLatexFromHtml('&amp;lt;')).toBe('&lt;');
+            expect(cleanLatexFromHtml('&amp;amp;')).toBe('&amp;');
+        });
+
+        it('should still decode genuine entities', () => {
+            expect(cleanLatexFromHtml('&lt;')).toBe('<');
+            expect(cleanLatexFromHtml('&gt;')).toBe('>');
+            expect(cleanLatexFromHtml('&amp;')).toBe('&');
+            expect(cleanLatexFromHtml('&quot;')).toBe('"');
+            expect(cleanLatexFromHtml('a&nbsp;b')).toBe('a b');
+            expect(cleanLatexFromHtml('&#65;')).toBe('A');
+            expect(cleanLatexFromHtml('&#x41;')).toBe('A');
+        });
+    });
+
     describe('preRenderDataGameLatex', () => {
         it('should decrypt, pre-render, and re-encrypt DataGame content', async () => {
             // Create encrypted JSON with LaTeX
diff --git a/src/shared/export/prerender/ServerLatexPreRenderer.ts b/src/shared/export/prerender/ServerLatexPreRenderer.ts
index dc0127c625..6047125ada 100644
--- a/src/shared/export/prerender/ServerLatexPreRenderer.ts
+++ b/src/shared/export/prerender/ServerLatexPreRenderer.ts
@@ -84,20 +84,26 @@ function encrypt(str: string): string {
 /**
  * Clean LaTeX string by removing HTML tags and decoding entities
  */
-function cleanLatexFromHtml(latexWithHtml: string): string {
+export function cleanLatexFromHtml(latexWithHtml: string): string {
     // Remove <br> tags - replace with newlines
     let clean = latexWithHtml.replace(/<br\s*\/?>/gi, '\n');
-    // Remove any other HTML tags
-    clean = clean.replace(/<[^>]+>/g, '');
-    // Decode common HTML entities
+    // Remove any other HTML tags, repeating until stable so nested/obfuscated
+    // tags (e.g. <scr<script>ipt>) cannot reassemble into a new tag.
+    let prev: string;
+    do {
+        prev = clean;
+        clean = clean.replace(/<[^>]+>/g, '');
+    } while (clean !== prev);
+    // Decode common HTML entities. Decode named/numeric entities first and the
+    // ampersand last so literal text like "&amp;lt;" does not become "<".
     clean = clean
         .replace(/&nbsp;/gi, ' ')
         .replace(/&lt;/g, '<')
         .replace(/&gt;/g, '>')
-        .replace(/&amp;/g, '&')
         .replace(/&quot;/g, '"')
         .replace(/&#(\d+);/g, (_, code) => String.fromCharCode(Number.parseInt(code, 10)))
-        .replace(/&#x([a-fA-F0-9]+);/g, (_, code) => String.fromCharCode(Number.parseInt(code, 16)));
+        .replace(/&#x([a-fA-F0-9]+);/g, (_, code) => String.fromCharCode(Number.parseInt(code, 16)))
+        .replace(/&amp;/g, '&');
     return clean;
 }
 
diff --git a/src/shared/export/prerender/ServerMermaidPreRenderer.spec.ts b/src/shared/export/prerender/ServerMermaidPreRenderer.spec.ts
index acb2463bd0..76c48084b1 100644
--- a/src/shared/export/prerender/ServerMermaidPreRenderer.spec.ts
+++ b/src/shared/export/prerender/ServerMermaidPreRenderer.spec.ts
@@ -8,7 +8,7 @@
  */
 
 import { describe, it, expect, beforeAll, afterAll } from 'bun:test';
-import { ServerMermaidPreRenderer } from './ServerMermaidPreRenderer';
+import { ServerMermaidPreRenderer, decodeHtmlEntities } from './ServerMermaidPreRenderer';
 
 describe('ServerMermaidPreRenderer', () => {
     let renderer: ServerMermaidPreRenderer;
@@ -128,6 +128,37 @@ describe('ServerMermaidPreRenderer', () => {
         });
     });
 
+    describe('decodeHtmlEntities (decode order / double-decoding)', () => {
+        it('should not double-decode &amp;lt; into < (entity decoded last)', () => {
+            // The literal text "&lt;" is stored as "&amp;lt;". Decoding the
+            // ampersand entity FIRST would wrongly collapse this to "<".
+            expect(decodeHtmlEntities('&amp;lt;')).toBe('&lt;');
+        });
+
+        it('should not double-decode &amp;amp; into & ', () => {
+            expect(decodeHtmlEntities('&amp;amp;')).toBe('&amp;');
+        });
+
+        it('should not double-decode an escaped script payload', () => {
+            // Attacker-controlled literal "&lt;script&gt;" arrives as
+            // "&amp;lt;script&amp;gt;" and must NOT become "<script>".
+            expect(decodeHtmlEntities('&amp;lt;script&amp;gt;')).toBe('&lt;script&gt;');
+        });
+
+        it('should still decode legitimate single-level entities', () => {
+            expect(decodeHtmlEntities('&lt;')).toBe('<');
+            expect(decodeHtmlEntities('&gt;')).toBe('>');
+            expect(decodeHtmlEntities('&amp;')).toBe('&');
+            expect(decodeHtmlEntities('&quot;')).toBe('"');
+            expect(decodeHtmlEntities('&#39;')).toBe("'");
+            expect(decodeHtmlEntities('&nbsp;')).toBe(' ');
+        });
+
+        it('should decode a realistic mermaid snippet without corruption', () => {
+            expect(decodeHtmlEntities('A[&quot;a &amp; b&quot;] --&gt; B')).toBe('A["a & b"] --> B');
+        });
+    });
+
     describe('destroy', () => {
         it('should clean up resources without error', () => {
             const localRenderer = new ServerMermaidPreRenderer();
diff --git a/src/shared/export/prerender/ServerMermaidPreRenderer.ts b/src/shared/export/prerender/ServerMermaidPreRenderer.ts
index 164a10a9f4..4c47ca3585 100644
--- a/src/shared/export/prerender/ServerMermaidPreRenderer.ts
+++ b/src/shared/export/prerender/ServerMermaidPreRenderer.ts
@@ -30,16 +30,22 @@ function escapeHtmlAttribute(text: string): string {
 }
 
 /**
- * Decode HTML entities in mermaid code
+ * Decode HTML entities in mermaid code.
+ *
+ * The ampersand entity (&amp; -> &) MUST be decoded LAST. Decoding it first
+ * would let the literal text "&lt;" (stored as "&amp;lt;") wrongly collapse to
+ * "<", double-decoding attacker-controlled content.
+ *
+ * Exported for unit testing of the decode-order security property.
  */
-function decodeHtmlEntities(text: string): string {
+export function decodeHtmlEntities(text: string): string {
     return text
         .replace(/&lt;/g, '<')
         .replace(/&gt;/g, '>')
-        .replace(/&amp;/g, '&')
         .replace(/&quot;/g, '"')
         .replace(/&#39;/g, "'")
-        .replace(/&nbsp;/g, ' ');
+        .replace(/&nbsp;/g, ' ')
+        .replace(/&amp;/g, '&');
 }
 
 // Import mermaid dynamically to handle the ESM module
diff --git a/src/shared/import/ElpxImporter.spec.ts b/src/shared/import/ElpxImporter.spec.ts
index 20dc038821..e30c9ccc6d 100644
--- a/src/shared/import/ElpxImporter.spec.ts
+++ b/src/shared/import/ElpxImporter.spec.ts
@@ -3169,4 +3169,68 @@ describe('ElpxImporter - remapInternalPageLinks prefix-collision safety', () =>
 
         ydoc.destroy();
     });
+
+    describe('HTML entity decoding (double-escaping)', () => {
+        let importer: ElpxImporter;
+        let decodeDir: string;
+
+        beforeEach(() => {
+            decodeDir = path.join('/tmp', `elp-decode-${Date.now()}-${Math.random().toString(36).substring(7)}`);
+            if (!existsSync(decodeDir)) {
+                mkdirSync(decodeDir, { recursive: true });
+            }
+            const ydoc = new Y.Doc();
+            const assetHandler = new FileSystemAssetHandler(decodeDir);
+            importer = new ElpxImporter(ydoc, assetHandler, silentLogger);
+        });
+
+        afterEach(() => {
+            if (existsSync(decodeDir)) {
+                rmSync(decodeDir, { recursive: true, force: true });
+            }
+        });
+
+        describe('decodeHtmlContent', () => {
+            const decode = (text: string): string => (importer as any).decodeHtmlContent(text);
+
+            it('does not double-decode pre-escaped entities (&amp;lt; stays literal &lt;)', () => {
+                // Security: "&amp;lt;" is the escaped form of the literal text "&lt;".
+                // It must NOT collapse into "<", which would re-enable smuggled markup.
+                expect(decode('&amp;lt;')).toBe('&lt;');
+                expect(decode('&amp;amp;')).toBe('&amp;');
+                expect(decode('&amp;gt;')).toBe('&gt;');
+                expect(decode('&amp;#39;')).toBe('&#39;');
+                expect(decode('&amp;#x3C;')).toBe('&#x3C;');
+            });
+
+            it('still decodes legitimate single-level entities', () => {
+                expect(decode('&lt;b&gt;hi&lt;/b&gt;')).toBe('<b>hi</b>');
+                expect(decode('a &amp; b')).toBe('a & b');
+                expect(decode('&quot;q&quot;')).toBe('"q"');
+                expect(decode('&#39;x&#39;')).toBe("'x'");
+                expect(decode('&apos;y&apos;')).toBe("'y'");
+                expect(decode('&#x41;&#66;')).toBe('AB');
+                expect(decode('')).toBe('');
+            });
+        });
+
+        describe('decodeHtmlContentForJson', () => {
+            const decode = (text: string): string => (importer as any).decodeHtmlContentForJson(text);
+
+            it('does not double-decode pre-escaped entities (&amp;lt; stays literal &lt;)', () => {
+                expect(decode('&amp;lt;')).toBe('&lt;');
+                expect(decode('&amp;amp;')).toBe('&amp;');
+                expect(decode('&amp;gt;')).toBe('&gt;');
+            });
+
+            it('decodes single-level entities while keeping &quot; intact for JSON safety', () => {
+                expect(decode('&lt;a&gt;')).toBe('<a>');
+                expect(decode('x &amp; y')).toBe('x & y');
+                expect(decode('&quot;keep&quot;')).toBe('&quot;keep&quot;');
+                expect(decode('&#39;z&#39;')).toBe("'z'");
+                expect(decode('&#x41;&#66;')).toBe('AB');
+                expect(decode('')).toBe('');
+            });
+        });
+    });
 });
diff --git a/src/shared/import/ElpxImporter.ts b/src/shared/import/ElpxImporter.ts
index 0bb61f48a4..d915f028c2 100644
--- a/src/shared/import/ElpxImporter.ts
+++ b/src/shared/import/ElpxImporter.ts
@@ -1339,14 +1339,16 @@ export class ElpxImporter {
         if (!text) return '';
 
         // Keep &quot; intact here to avoid breaking JSON strings that embed HTML attributes.
+        // Decode &amp; LAST so that pre-escaped entities like "&amp;lt;" (literal text
+        // "&lt;") are preserved instead of collapsing to "<".
         return text
             .replace(/&lt;/g, '<')
             .replace(/&gt;/g, '>')
-            .replace(/&amp;/g, '&')
             .replace(/&#39;/g, "'")
             .replace(/&apos;/g, "'")
             .replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
-            .replace(/&#(\d+);/g, (_, dec) => String.fromCharCode(parseInt(dec, 10)));
+            .replace(/&#(\d+);/g, (_, dec) => String.fromCharCode(parseInt(dec, 10)))
+            .replace(/&amp;/g, '&');
     }
 
     private hasCdataChild(element: Element): boolean {
@@ -1924,16 +1926,17 @@ export class ElpxImporter {
     private decodeHtmlContent(text: string): string {
         if (!text) return '';
 
-        // Decode common HTML entities
+        // Decode common HTML entities. Decode &amp; LAST so that pre-escaped entities
+        // like "&amp;lt;" (literal text "&lt;") are preserved instead of collapsing to "<".
         return text
             .replace(/&lt;/g, '<')
             .replace(/&gt;/g, '>')
-            .replace(/&amp;/g, '&')
             .replace(/&quot;/g, '"')
             .replace(/&#39;/g, "'")
             .replace(/&apos;/g, "'")
             .replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
-            .replace(/&#(\d+);/g, (_, dec) => String.fromCharCode(parseInt(dec, 10)));
+            .replace(/&#(\d+);/g, (_, dec) => String.fromCharCode(parseInt(dec, 10)))
+            .replace(/&amp;/g, '&');
     }
 
     /**
diff --git a/src/shared/import/LegacyXmlParser.spec.ts b/src/shared/import/LegacyXmlParser.spec.ts
index 5c9ca7c094..020b0d1c31 100644
--- a/src/shared/import/LegacyXmlParser.spec.ts
+++ b/src/shared/import/LegacyXmlParser.spec.ts
@@ -104,6 +104,35 @@ describe('LegacyXmlParser', () => {
         });
     });
 
+    describe('decodeHtmlContent', () => {
+        // decodeHtmlContent is private; access via cast for direct unit testing.
+        const decode = (text: string): string =>
+            (parser as unknown as { decodeHtmlContent: (t: string) => string }).decodeHtmlContent(text);
+
+        it('should return empty string for empty input', () => {
+            expect(decode('')).toBe('');
+        });
+
+        it('should decode named and numeric entities', () => {
+            expect(decode('&lt;b&gt;hi&lt;/b&gt;')).toBe('<b>hi</b>');
+            expect(decode('&quot;x&quot;')).toBe('"x"');
+            expect(decode('&#39;a&apos;b')).toBe("'a'b");
+            expect(decode('&#x41;&#66;')).toBe('AB');
+        });
+
+        it('should decode a bare ampersand entity', () => {
+            expect(decode('Tom &amp; Jerry')).toBe('Tom & Jerry');
+        });
+
+        // Security: decoding &amp; must happen LAST so the literal text "&lt;"
+        // (encoded as "&amp;lt;") is not double-decoded into a real "<".
+        it('should not double-decode escaped entities', () => {
+            expect(decode('&amp;lt;')).toBe('&lt;');
+            expect(decode('&amp;amp;')).toBe('&amp;');
+            expect(decode('&amp;lt;script&amp;gt;')).toBe('&lt;script&gt;');
+        });
+    });
+
     describe('getLocalizedCaseStudyTitle', () => {
         it('should return Spanish title for es language', () => {
             const result = parser.getLocalizedCaseStudyTitle('es');
diff --git a/src/shared/import/LegacyXmlParser.ts b/src/shared/import/LegacyXmlParser.ts
index da0baa8be5..9c12639fde 100644
--- a/src/shared/import/LegacyXmlParser.ts
+++ b/src/shared/import/LegacyXmlParser.ts
@@ -2329,12 +2329,12 @@ export class LegacyXmlParser {
         return text
             .replace(/&lt;/g, '<')
             .replace(/&gt;/g, '>')
-            .replace(/&amp;/g, '&')
             .replace(/&quot;/g, '"')
             .replace(/&#39;/g, "'")
             .replace(/&apos;/g, "'")
             .replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => String.fromCharCode(parseInt(hex, 16)))
-            .replace(/&#(\d+);/g, (_, dec) => String.fromCharCode(parseInt(dec, 10)));
+            .replace(/&#(\d+);/g, (_, dec) => String.fromCharCode(parseInt(dec, 10)))
+            .replace(/&amp;/g, '&');
     }
 
     /**
diff --git a/src/shared/import/legacy-handlers/BaseLegacyHandler.spec.ts b/src/shared/import/legacy-handlers/BaseLegacyHandler.spec.ts
index 32045e38bc..2679dbf09e 100644
--- a/src/shared/import/legacy-handlers/BaseLegacyHandler.spec.ts
+++ b/src/shared/import/legacy-handlers/BaseLegacyHandler.spec.ts
@@ -409,6 +409,16 @@ describe('BaseLegacyHandler', () => {
             // \\r followed by 'i' in 'right' should NOT be converted
             expect(handler.decodeHtmlContent(latex)).toBe('\\left( x \\right)');
         });
+
+        it('should not double-decode &amp;lt; into a real angle bracket', () => {
+            // &amp;lt; is the literal text "&lt;" and must stay that way,
+            // not collapse to "<" via two decode passes.
+            expect(handler.decodeHtmlContent('&amp;lt;')).toBe('&lt;');
+        });
+
+        it('should not double-decode &amp;amp;', () => {
+            expect(handler.decodeHtmlContent('&amp;amp;')).toBe('&amp;');
+        });
     });
 
     describe('stripHtmlTags', () => {
@@ -443,6 +453,30 @@ describe('BaseLegacyHandler', () => {
         it('should trim result', () => {
             expect(handler.stripHtmlTags('  <p>  Hello  </p>  ')).toBe('Hello');
         });
+
+        it('should remove nested/obfuscated script payloads (no <script left)', () => {
+            const result = handler.stripHtmlTags('<scr<script>ipt>alert(1)</script>After');
+            // The single-pass strip would have spliced the two halves back into
+            // a live <script>; looping to a fixed point prevents that.
+            expect(result.toLowerCase()).not.toContain('<script');
+            expect(result).not.toContain('alert(1)');
+        });
+
+        it('should remove script end tags with whitespace before the angle bracket', () => {
+            expect(handler.stripHtmlTags('Before<script>alert(1)</script >After')).toBe('BeforeAfter');
+        });
+
+        it('should remove script end tags spanning newlines and mixed case', () => {
+            expect(handler.stripHtmlTags('Before<SCRIPT>\nalert(1)\n</ScRiPt\n>After')).toBe('BeforeAfter');
+        });
+
+        it('should remove style end tags with whitespace before the angle bracket', () => {
+            expect(handler.stripHtmlTags('Before<style>.red{color:red}</style >After')).toBe('BeforeAfter');
+        });
+
+        it('should not double-decode &amp;lt; into a real angle bracket', () => {
+            expect(handler.stripHtmlTags('&amp;lt;')).toBe('&lt;');
+        });
     });
 
     describe('escapeHtmlAttr', () => {
diff --git a/src/shared/import/legacy-handlers/BaseLegacyHandler.ts b/src/shared/import/legacy-handlers/BaseLegacyHandler.ts
index f5966a0ea4..7590e377b1 100644
--- a/src/shared/import/legacy-handlers/BaseLegacyHandler.ts
+++ b/src/shared/import/legacy-handlers/BaseLegacyHandler.ts
@@ -411,12 +411,12 @@ export abstract class BaseLegacyHandler implements IdeviceHandler {
 
         // Handle Python-style unicode escapes and HTML entities
         const decoded = content
-            // Decode common HTML entities
+            // Decode common HTML entities (ampersand last to avoid double-decoding)
             .replace(/&lt;/g, '<')
             .replace(/&gt;/g, '>')
-            .replace(/&amp;/g, '&')
             .replace(/&quot;/g, '"')
             .replace(/&#39;/g, "'")
+            .replace(/&amp;/g, '&')
             // Handle Python unicode escapes for common characters
             .replace(/\\n/g, '\n')
             .replace(/\\t/g, '\t')
@@ -448,20 +448,31 @@ export abstract class BaseLegacyHandler implements IdeviceHandler {
     stripHtmlTags(html: string): string {
         if (!html) return '';
 
-        // Use regex to strip HTML tags (works in both environments)
-        const text = html
-            // Remove script and style content
-            .replace(/<script[^>]*>[\s\S]*?<\/script>/gi, '')
-            .replace(/<style[^>]*>[\s\S]*?<\/style>/gi, '')
-            // Remove HTML tags
-            .replace(/<[^>]*>/g, '')
-            // Decode common HTML entities
+        // Use regex to strip HTML tags (works in both environments).
+        // Apply the tag-removal passes repeatedly until the string stops
+        // changing, so that removing one match cannot splice two halves into a
+        // new match (e.g. <scr<script>ipt> -> <script>). End-tag patterns
+        // tolerate optional whitespace/newlines before the closing '>'.
+        let stripped = html;
+        let previous: string;
+        do {
+            previous = stripped;
+            stripped = stripped
+                // Remove script and style content
+                .replace(/<script[^>]*>[\s\S]*?<\/script\s*>/gi, '')
+                .replace(/<style[^>]*>[\s\S]*?<\/style\s*>/gi, '')
+                // Remove HTML tags
+                .replace(/<[^>]*>/g, '');
+        } while (stripped !== previous);
+
+        const text = stripped
+            // Decode common HTML entities (ampersand last to avoid double-decoding)
             .replace(/&nbsp;/g, ' ')
             .replace(/&lt;/g, '<')
             .replace(/&gt;/g, '>')
-            .replace(/&amp;/g, '&')
             .replace(/&quot;/g, '"')
             .replace(/&#39;/g, "'")
+            .replace(/&amp;/g, '&')
             // Collapse whitespace
             .replace(/\s+/g, ' ');
 
diff --git a/src/shared/import/legacy-handlers/GameHandler.ts b/src/shared/import/legacy-handlers/GameHandler.ts
index 5419afec51..39e83d46e7 100644
--- a/src/shared/import/legacy-handlers/GameHandler.ts
+++ b/src/shared/import/legacy-handlers/GameHandler.ts
@@ -310,8 +310,10 @@ export class GameHandler extends BaseLegacyHandler {
                     // Create the new JSON string
                     const newJson = JSON.stringify(parsedData);
 
-                    // Use regex to replace the DataGame div content
-                    const escapedClass = divClass.replace(/-/g, '\\-');
+                    // Use regex to replace the DataGame div content.
+                    // Escape backslashes first, then hyphens, so a backslash in the
+                    // class name cannot leak an unescaped escape character into the regex.
+                    const escapedClass = divClass.replace(/\\/g, '\\\\').replace(/-/g, '\\-');
                     const regex = new RegExp(
                         `(<div[^>]*class="[^"]*${escapedClass}[^"]*"[^>]*>)[\\s\\S]*?(<\\/div>)`,
                         'i',
@@ -377,8 +379,10 @@ export class GameHandler extends BaseLegacyHandler {
     private extractGameDataFromHtml(html: string, divClass: string): string | null {
         if (!html) return null;
 
-        // Use regex patterns for extraction
-        const escapedClass = divClass.replace(/-/g, '\\-');
+        // Use regex patterns for extraction.
+        // Escape backslashes first, then hyphens, so a backslash in the class name
+        // cannot leak an unescaped escape character into the regex.
+        const escapedClass = divClass.replace(/\\/g, '\\\\').replace(/-/g, '\\-');
         const patterns = [
             // Match div with class, capturing everything until closing </div>
             new RegExp(`<div[^>]*class="[^"]*${escapedClass}[^"]*"[^>]*>([\\s\\S]*?)<\\/div>`, 'i'),
diff --git a/src/shared/import/legacy-handlers/InteractiveVideoHandler.spec.ts b/src/shared/import/legacy-handlers/InteractiveVideoHandler.spec.ts
new file mode 100644
index 0000000000..1febd16d14
--- /dev/null
+++ b/src/shared/import/legacy-handlers/InteractiveVideoHandler.spec.ts
@@ -0,0 +1,60 @@
+/**
+ * InteractiveVideoHandler Unit Tests
+ *
+ * Focused tests for the HTML entity decoding chain used when transforming
+ * legacy Interactive Video iDevices. The decode order matters for security:
+ * ampersand must be decoded LAST so that double-encoded entities such as
+ * "&amp;lt;" decode to the literal text "&lt;" and not to "<".
+ */
+
+import { describe, it, expect, beforeEach } from 'bun:test';
+
+import { InteractiveVideoHandler } from './InteractiveVideoHandler';
+
+/**
+ * Test subclass exposing the private decodeHtmlEntities method.
+ */
+class TestableInteractiveVideoHandler extends InteractiveVideoHandler {
+    public decode(str: string): string {
+        // Access the private method through the instance for testing.
+        return (this as unknown as { decodeHtmlEntities(s: string): string }).decodeHtmlEntities(str);
+    }
+}
+
+describe('InteractiveVideoHandler.decodeHtmlEntities', () => {
+    let handler: TestableInteractiveVideoHandler;
+
+    beforeEach(() => {
+        handler = new TestableInteractiveVideoHandler();
+    });
+
+    it('returns empty string for empty input', () => {
+        expect(handler.decode('')).toBe('');
+    });
+
+    it('decodes simple named entities', () => {
+        expect(handler.decode('&lt;div&gt;')).toBe('<div>');
+        expect(handler.decode('&quot;hi&quot;')).toBe('"hi"');
+        expect(handler.decode('&#39;x&#39;')).toBe("'x'");
+        expect(handler.decode('a&nbsp;b')).toBe('a b');
+        expect(handler.decode('a&amp;b')).toBe('a&b');
+    });
+
+    it('does not double-decode encoded entities (ampersand decoded last)', () => {
+        // Security property: the literal text "&lt;" was encoded as "&amp;lt;".
+        // It must decode back to "&lt;", NOT to "<".
+        expect(handler.decode('&amp;lt;')).toBe('&lt;');
+        expect(handler.decode('&amp;gt;')).toBe('&gt;');
+        expect(handler.decode('&amp;quot;')).toBe('&quot;');
+        // "&amp;amp;" is the encoded form of "&amp;" and must decode to "&amp;".
+        expect(handler.decode('&amp;amp;')).toBe('&amp;');
+    });
+
+    it('does not let a double-encoded script tag inject markup', () => {
+        // "&amp;lt;script&amp;gt;" is the safe encoded form of the literal
+        // text "&lt;script&gt;" and must NOT decode to a real "<script>" tag.
+        const decoded = handler.decode('&amp;lt;script&amp;gt;');
+        expect(decoded).toBe('&lt;script&gt;');
+        expect(decoded).not.toContain('<script>');
+    });
+});
diff --git a/src/shared/import/legacy-handlers/InteractiveVideoHandler.ts b/src/shared/import/legacy-handlers/InteractiveVideoHandler.ts
index 6771950cf2..469a9e8a4c 100644
--- a/src/shared/import/legacy-handlers/InteractiveVideoHandler.ts
+++ b/src/shared/import/legacy-handlers/InteractiveVideoHandler.ts
@@ -207,10 +207,10 @@ export class InteractiveVideoHandler extends BaseLegacyHandler {
         return str
             .replace(/&lt;/g, '<')
             .replace(/&gt;/g, '>')
-            .replace(/&amp;/g, '&')
             .replace(/&quot;/g, '"')
             .replace(/&#39;/g, "'")
-            .replace(/&nbsp;/g, ' ');
+            .replace(/&nbsp;/g, ' ')
+            .replace(/&amp;/g, '&');
     }
 
     /**
diff --git a/src/shared/import/legacy-handlers/handlers.spec.ts b/src/shared/import/legacy-handlers/handlers.spec.ts
index f0f0bd230d..fcfdae0f6c 100644
--- a/src/shared/import/legacy-handlers/handlers.spec.ts
+++ b/src/shared/import/legacy-handlers/handlers.spec.ts
@@ -3966,6 +3966,57 @@ describe('GameHandler', () => {
             expect(props.typeGame).toBe('FlipCards');
         });
     });
+
+    describe('regex class-name escaping (incomplete-sanitization fix)', () => {
+        // The DataGame class names contain hyphens (e.g. "flipcards-DataGame").
+        // GameHandler escapes those class names before interpolating them into a
+        // RegExp. The escaping must remain complete (backslash-first, then hyphen)
+        // so the generated regex stays valid and correctly anchored for every
+        // legitimate, hyphenated class name.
+        function makeDict(divClass: string, jsonContent: string): Element {
+            const encoded = jsonContent
+                .replace(/&/g, '&amp;')
+                .replace(/</g, '&lt;')
+                .replace(/>/g, '&gt;')
+                .replace(/"/g, '&quot;');
+            const value = `&lt;div class=&quot;${divClass}&quot;&gt;${encoded}&lt;/div&gt;`;
+            return createDomElement(`
+                <dictionary>
+                    <string role="key" value="fields"/>
+                    <list>
+                        <instance class="TextAreaField">
+                            <dictionary>
+                                <string role="key" value="content"/>
+                                <unicode value="${value}"/>
+                            </dictionary>
+                        </instance>
+                    </list>
+                </dictionary>
+            `);
+        }
+
+        it('extracts data from a hyphenated DataGame class name', () => {
+            // Exercises extractGameDataFromHtml's escaping seam: the hyphen-bearing
+            // class name must still match. word-search-DataGame has two hyphens.
+            const dict = makeDict('word-search-DataGame', '{"typeGame":"WordSearch","words":["x"]}');
+            const props = handler.extractProperties(dict);
+            expect(props.typeGame).toBe('WordSearch');
+            expect(props.words).toEqual(['x']);
+        });
+
+        it('rewrites the DataGame div for a non-encrypted game', () => {
+            // Exercises updateDataGameDivInHtml's escaping seam (line 314 path).
+            // flipcards is non-encrypted, so the div content is re-serialized.
+            const dict = makeDict('flipcards-DataGame', '{"typeGame":"FlipCards","cards":[1]}');
+            const html = handler.extractHtmlView(dict);
+            expect(html).toContain('flipcards-DataGame');
+            // The escaped regex must still anchor on the hyphenated class and the
+            // rewritten JSON must be present (HTML-escaped via escapeHtml) inside
+            // the div. escapeHtml turns the JSON quotes into &quot;.
+            expect(html).toContain('FlipCards');
+            expect(html).toContain('{&quot;typeGame&quot;:&quot;FlipCards&quot;');
+        });
+    });
 });
 
 describe('FpdSolvedExerciseHandler', () => {
diff --git a/test/e2e/playwright/specs/idevices/image-gallery.spec.ts b/test/e2e/playwright/specs/idevices/image-gallery.spec.ts
index 60bd7a406d..d22d04ea59 100644
--- a/test/e2e/playwright/specs/idevices/image-gallery.spec.ts
+++ b/test/e2e/playwright/specs/idevices/image-gallery.spec.ts
@@ -1183,8 +1183,12 @@ test.describe('Image Gallery iDevice', () => {
                     return;
                 }
                 // Fallback: dispatch a real dblclick event on the folder tile.
+                // Escape backslashes first, then double-quotes, so the value
+                // is safely embedded in the quoted CSS attribute selector even
+                // when the folder name itself contains a backslash or quote.
+                const escapedName = name.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
                 const el = document.querySelector(
-                    `#modalFileManager .media-library-folder[data-folder-name="${name.replace(/"/g, '\\"')}"]`,
+                    `#modalFileManager .media-library-folder[data-folder-name="${escapedName}"]`,
                 );
                 if (!el) throw new Error(`Folder tile not found: ${name}`);
                 el.dispatchEvent(new MouseEvent('dblclick', { bubbles: true, cancelable: true }));
diff --git a/test/integration/latex-text-idevice-export.spec.ts b/test/integration/latex-text-idevice-export.spec.ts
index 18c4835465..c5dc822d52 100644
--- a/test/integration/latex-text-idevice-export.spec.ts
+++ b/test/integration/latex-text-idevice-export.spec.ts
@@ -248,7 +248,7 @@ describe('LaTeX Pre-rendering Export Integration', () => {
             // If pre-rendered, all data-latex should contain valid LaTeX, not HTML
             const dataLatexMatches = html.match(/data-latex="([^"]*)"/g) || [];
             for (const match of dataLatexMatches) {
-                const value = match.replace('data-latex="', '').replace('"', '');
+                const value = match.replace('data-latex="', '').replace(/"/g, '');
                 // data-latex should contain LaTeX delimiters or LaTeX commands, not HTML
                 expect(value).not.toContain('<span');
                 expect(value).not.toContain('&lt;span');
diff --git a/views/admin/index.njk b/views/admin/index.njk
index e5d5c9c825..26a7e87b6d 100644
--- a/views/admin/index.njk
+++ b/views/admin/index.njk
@@ -3191,7 +3191,7 @@ window.$eXeLearningCustom = {
                             <a class="btn-admin-outline" href="/workarea?project=${project.uuid}" target="_blank" title="{{ t.view_project or 'View Project' }}">
                                 <span class="mi mi-sm">open_in_new</span>
                             </a>
-                            <button class="btn-admin-outline" onclick="downloadProjectElpx(${project.id}, '${(project.title || '').replace(/'/g, "\\'")}')" title="{{ t.download_elpx or 'Download .elpx' }}">
+                            <button class="btn-admin-outline" onclick="downloadProjectElpx(${project.id}, '${(project.title || '').replace(/\\/g, '\\\\').replace(/'/g, "\\'")}')" title="{{ t.download_elpx or 'Download .elpx' }}">
                                 <span class="mi mi-sm">download</span>
                             </button>
                             ` : ''}

From b53a50f8cc79bc71953da3bb0570f137ecb0423d Mon Sep 17 00:00:00 2001
From: erseco <info@ernesto.es>
Date: Thu, 18 Jun 2026 16:41:12 +0100
Subject: [PATCH 2/3] fix(security): address review findings on the CodeQL
 hardening PR

- EmbeddingBridge: route _announceDocumentLoaded through postToParent so the
  DOCUMENT_LOADED metadata (projectId, isDirty, pageCount) is no longer
  broadcast to '*' when the parent origin is unknown. Closes the residual
  js/cross-window-information-leak the postToParent fix had missed. Updated the
  pre-existing test that asserted the old wildcard behavior.
- link-validator: make the server-side normalizeUrlForSchemeCheck decode the
  full named/numeric HTML-entity set (e.g. &#106;avascript:, javascript&#58;,
  data&colon;) with an out-of-range-safe code-point helper, matching the
  client LinkValidationAdapter._hasDangerousScheme so both ends reject the same
  links. Added tests for entity-encoded scheme chars and out-of-range entities.
- project.ts: remove the now-dead isUnsafeLinkScheme() (superseded by the shared
  link-validator service; zero call sites) and its spec block.
---
 public/app/core/EmbeddingBridge.js      | 11 ++++--
 public/app/core/EmbeddingBridge.test.js | 15 ++++---
 src/routes/project.spec.ts              | 44 ---------------------
 src/routes/project.ts                   | 22 -----------
 src/services/link-validator.spec.ts     | 27 +++++++++++++
 src/services/link-validator.ts          | 52 ++++++++++++++++++-------
 6 files changed, 83 insertions(+), 88 deletions(-)

diff --git a/public/app/core/EmbeddingBridge.js b/public/app/core/EmbeddingBridge.js
index 5c6840cb57..2bac3bb9df 100644
--- a/public/app/core/EmbeddingBridge.js
+++ b/public/app/core/EmbeddingBridge.js
@@ -92,14 +92,17 @@ export default class EmbeddingBridge {
         const documentManager = bridge?.documentManager;
         const navigation = documentManager?.getNavigation?.();
 
-        window.parent.postMessage({
+        // Route through postToParent so this inherits the known-origin guard.
+        // DOCUMENT_LOADED carries project metadata (id, dirty state, page count)
+        // that must never be broadcast to '*': until the parent handshake has
+        // set a trusted parentOrigin, the message is dropped rather than leaked
+        // to every embedding origin (js/cross-window-information-leak).
+        this.postToParent({
             type: 'DOCUMENT_LOADED',
             projectId: bridge?.projectId || null,
             isDirty: documentManager?.isDirty || false,
             pageCount: navigation?.length || 0,
-        }, this.parentOrigin || '*');
-
-        getLogger().log('[EmbeddingBridge] Announced DOCUMENT_LOADED to parent');
+        });
     }
 
     /**
diff --git a/public/app/core/EmbeddingBridge.test.js b/public/app/core/EmbeddingBridge.test.js
index 0353e5b345..b5bee205ac 100644
--- a/public/app/core/EmbeddingBridge.test.js
+++ b/public/app/core/EmbeddingBridge.test.js
@@ -1178,24 +1178,25 @@ describe('EmbeddingBridge', () => {
             );
         });
 
-        it('should use * as target origin when parentOrigin is not set', async () => {
+        it('does not broadcast DOCUMENT_LOADED to "*" when parentOrigin is not set', async () => {
             let resolveDocReady;
             window.eXeLearning.documentReady = new Promise((resolve) => {
                 resolveDocReady = resolve;
             });
 
             bridge.init();
-            // parentOrigin is null by default
+            // parentOrigin is null by default (no parent handshake received yet)
 
             resolveDocReady();
             await new Promise(resolve => setTimeout(resolve, 0));
 
-            // Should have posted DOCUMENT_LOADED with '*' origin
+            // The project metadata (id, dirty state, page count) must NOT leak to
+            // every embedding origin: with no known parent origin the announcement
+            // is dropped rather than sent to '*' (js/cross-window-information-leak).
             const docLoadedCall = window.parent.postMessage.mock.calls.find(
                 call => call[0]?.type === 'DOCUMENT_LOADED'
             );
-            expect(docLoadedCall).toBeTruthy();
-            expect(docLoadedCall[1]).toBe('*');
+            expect(docLoadedCall).toBeUndefined();
         });
 
         it('should handle missing yjsBridge gracefully in DOCUMENT_LOADED', async () => {
@@ -1207,6 +1208,9 @@ describe('EmbeddingBridge', () => {
             mockApp.project._yjsBridge = null;
 
             bridge.init();
+            // A trusted parent origin is known, so the announcement is sent and
+            // we can assert it degrades gracefully (null/zero) without a bridge.
+            bridge.parentOrigin = 'https://parent.com';
             resolveDocReady();
             await new Promise(resolve => setTimeout(resolve, 0));
 
@@ -1217,6 +1221,7 @@ describe('EmbeddingBridge', () => {
             expect(docLoadedCall[0].projectId).toBeNull();
             expect(docLoadedCall[0].isDirty).toBe(false);
             expect(docLoadedCall[0].pageCount).toBe(0);
+            expect(docLoadedCall[1]).toBe('https://parent.com');
         });
 
         it('should not send DOCUMENT_LOADED when documentReady is not available', () => {
diff --git a/src/routes/project.spec.ts b/src/routes/project.spec.ts
index 89cce5ed8d..80145efae8 100644
--- a/src/routes/project.spec.ts
+++ b/src/routes/project.spec.ts
@@ -11,7 +11,6 @@ import {
     createProjectRoutes,
     createSymfonyCompatProjectRoutes,
     buildDefaultThemePayload,
-    isUnsafeLinkScheme,
     type ProjectDependencies,
     type SessionManagerDeps,
     type FileHelperDeps,
@@ -2143,49 +2142,6 @@ describe('Project Routes', () => {
         });
     });
 
-    describe('isUnsafeLinkScheme', () => {
-        it('treats script-capable schemes as unsafe', () => {
-            expect(isUnsafeLinkScheme('javascript:void(0)')).toBe(true);
-            expect(isUnsafeLinkScheme('vbscript:msgbox(1)')).toBe(true);
-            expect(isUnsafeLinkScheme('data:text/html,<script>alert(1)</script>')).toBe(true);
-        });
-
-        it('is case-insensitive', () => {
-            expect(isUnsafeLinkScheme('JavaScript:void(0)')).toBe(true);
-            expect(isUnsafeLinkScheme('VBScript:msgbox(1)')).toBe(true);
-            expect(isUnsafeLinkScheme('DATA:text/html,x')).toBe(true);
-        });
-
-        it('tolerates leading whitespace and control characters', () => {
-            expect(isUnsafeLinkScheme(' javascript:alert(1)')).toBe(true);
-            expect(isUnsafeLinkScheme('\t\njavascript:alert(1)')).toBe(true);
-            expect(isUnsafeLinkScheme(' vbscript:msgbox(1)')).toBe(true);
-            expect(isUnsafeLinkScheme(' \tdata:text/html,x')).toBe(true);
-            // Leading NUL (U+0000) and US (U+001F) control-char padding that
-            // URL parsers strip before resolving the scheme.
-            const nul = String.fromCharCode(0);
-            const us = String.fromCharCode(0x1f);
-            expect(isUnsafeLinkScheme(`${nul}javascript:alert(1)`)).toBe(true);
-            expect(isUnsafeLinkScheme(`${us}vbscript:msgbox(1)`)).toBe(true);
-            expect(isUnsafeLinkScheme(`${nul}${us} data:text/html,x`)).toBe(true);
-        });
-
-        it('keeps legitimate links safe', () => {
-            expect(isUnsafeLinkScheme('http://example.com')).toBe(false);
-            expect(isUnsafeLinkScheme('https://example.com/page')).toBe(false);
-            expect(isUnsafeLinkScheme('//cdn.example.com/a.js')).toBe(false);
-            expect(isUnsafeLinkScheme('mailto:user@example.com')).toBe(false);
-            expect(isUnsafeLinkScheme('tel:+34123456789')).toBe(false);
-            expect(isUnsafeLinkScheme('files/img/photo.png')).toBe(false);
-            expect(isUnsafeLinkScheme('exe-node:abc')).toBe(false);
-            expect(isUnsafeLinkScheme('#anchor')).toBe(false);
-            expect(isUnsafeLinkScheme('relative/path.html')).toBe(false);
-            expect(isUnsafeLinkScheme('')).toBe(false);
-            // Substrings of dangerous schemes must not trip the prefix check.
-            expect(isUnsafeLinkScheme('https://x/javascript:notscheme')).toBe(false);
-        });
-    });
-
     describe('Link Extraction (brokenlinks/extract)', () => {
         // Extract endpoint now requires authentication (bug H1); supply a token to each request.
         let authToken: string;
diff --git a/src/routes/project.ts b/src/routes/project.ts
index 45049e8e72..2a83274a1a 100644
--- a/src/routes/project.ts
+++ b/src/routes/project.ts
@@ -98,28 +98,6 @@ export async function resolveDefaultThemeForNewProject(
     return themeDirName;
 }
 
-/**
- * Returns true when a link URL uses a scheme that can execute script when
- * navigated/rendered (e.g. `javascript:`, `vbscript:`, `data:`) and must
- * therefore be discarded by the broken-link checker.
- *
- * The check is deliberately defensive: schemes are matched case-insensitively
- * and after stripping leading whitespace and C0 control characters, which
- * browsers ignore when resolving a URL. This prevents bypasses such as
- * `VBScript:...`, a leading-space `" javascript:..."`, or control-character
- * padding from slipping a dangerous scheme past the filter.
- *
- * Exported so the security property can be unit-tested directly.
- */
-export function isUnsafeLinkScheme(url: string): boolean {
-    if (!url) return false;
-    // Strip leading whitespace and C0 control chars that URL parsers ignore,
-    // so padded schemes (e.g. a leading-space javascript:) cannot bypass the check.
-    // biome-ignore lint/suspicious/noControlCharactersInRegex: intentionally matching the C0 control chars browsers ignore in URLs
-    const normalized = url.replace(/^[\s\u0000-\u001f]+/, '').toLowerCase();
-    return normalized.startsWith('javascript:') || normalized.startsWith('vbscript:') || normalized.startsWith('data:');
-}
-
 import { getAppVersion } from '../utils/version';
 import { buildSiteThemeUrl } from '../utils/site-theme-url';
 import { isSafePathSegment, isWithinBase } from '../utils/safe-path';
diff --git a/src/services/link-validator.spec.ts b/src/services/link-validator.spec.ts
index d2713f13da..3eeb3ce9c6 100644
--- a/src/services/link-validator.spec.ts
+++ b/src/services/link-validator.spec.ts
@@ -182,6 +182,33 @@ describe('Link Validator Service', () => {
             expect(result).toHaveLength(0);
         });
 
+        it('should remove schemes whose own letters/colon are HTML-entity encoded', () => {
+            // The old normalizer only decoded whitespace entities, so these
+            // (the scheme characters themselves encoded) slipped through. They
+            // must be caught to match the client-side LinkValidationAdapter.
+            const links: RawExtractedLink[] = [
+                { url: '&#106;avascript:alert(1)', count: 1 }, // 'j' as &#106;
+                { url: '&#x6a;avascript:alert(2)', count: 1 }, // 'j' as &#x6a;
+                { url: 'javascript&#58;alert(3)', count: 1 }, // ':' as &#58;
+                { url: 'javascript&colon;alert(4)', count: 1 }, // ':' as &colon;
+                { url: 'data&colon;text/html,evil', count: 1 },
+            ];
+            const result = removeInvalidLinks(links);
+            expect(result).toHaveLength(0);
+        });
+
+        it('should not throw on out-of-range numeric entities and keep the benign link', () => {
+            // Out-of-range code points must not crash String.fromCodePoint; the
+            // junk entity is dropped, so the benign link survives while the
+            // still-dangerous one is removed.
+            const links: RawExtractedLink[] = [
+                { url: 'https://example.com/&#x110000;page', count: 1 },
+                { url: '&#x110000;javascript:alert(1)', count: 1 },
+            ];
+            const result = removeInvalidLinks(links);
+            expect(result.map(l => l.url)).toEqual(['https://example.com/&#x110000;page']);
+        });
+
         it('should keep legitimate http/https/relative links', () => {
             const links: RawExtractedLink[] = [
                 { url: 'http://example.com', count: 1 },
diff --git a/src/services/link-validator.ts b/src/services/link-validator.ts
index d5b0b46767..f6fb7b26dd 100644
--- a/src/services/link-validator.ts
+++ b/src/services/link-validator.ts
@@ -92,21 +92,47 @@ export function cleanAndCountLinks(links: RawExtractedLink[]): RawExtractedLink[
 const DANGEROUS_URL_SCHEMES = ['javascript:', 'vbscript:', 'data:'];
 
 /**
- * Normalize a URL for scheme inspection: decode the HTML entities and strip
- * the leading whitespace / control characters that browsers ignore when
- * resolving a URL scheme, then lowercase the result. This prevents bypasses
- * such as " javascript:", "JaVaScRiPt:", or "java&#9;script:".
+ * Normalize a URL for scheme inspection so an encoded or padded scheme cannot
+ * slip past the dangerous-scheme filter. Decodes HTML entities (named and
+ * numeric - e.g. "java&#115;cript:", "javascript&#58;", "data&colon;..."),
+ * then strips the whitespace and C0/DEL control characters that browsers ignore
+ * when resolving a URL scheme, and lowercases the result. This prevents bypasses
+ * such as " javascript:", "JaVaScRiPt:", "java&#9;script:", or "&#106;avascript:".
+ *
+ * Kept in sync with the client-side `LinkValidationAdapter._hasDangerousScheme()`
+ * so the broken-link checker rejects the same set of links on both ends.
  */
 function normalizeUrlForSchemeCheck(url: string): string {
-    return (
-        url
-            // Decode HTML entities for whitespace/control chars (tab, LF, CR).
-            .replace(/&(?:#x0*9|#0*9|#x0*a|#0*10|#x0*d|#0*13|tab|newline);/gi, '')
-            // Strip leading/embedded whitespace and C0 control characters (U+0000-U+0020).
-            // biome-ignore lint/suspicious/noControlCharactersInRegex: intentionally matching the C0 control chars browsers ignore when resolving a URL scheme, to block obfuscated-scheme bypasses.
-            .replace(/[\u0000-\u0020]+/g, '')
-            .toLowerCase()
-    );
+    // Safely convert a numeric code point, returning '' for invalid or
+    // out-of-range values so String.fromCodePoint cannot throw a RangeError
+    // (e.g. on "&#x110000;" or "&#9999999999;"). Dropping such junk only makes
+    // scheme detection stricter, never weaker.
+    const safeFromCodePoint = (cp: number): string =>
+        Number.isInteger(cp) && cp >= 0 && cp <= 0x10ffff ? String.fromCodePoint(cp) : '';
+
+    const namedEntities: Record<string, string> = {
+        amp: '&',
+        lt: '<',
+        gt: '>',
+        quot: '"',
+        apos: "'",
+        colon: ':',
+        tab: '\t',
+        newline: '\n',
+    };
+
+    const decoded = url
+        .replace(/&#x([0-9a-f]+);?/gi, (_m, hex: string) => safeFromCodePoint(Number.parseInt(hex, 16)))
+        .replace(/&#(\d+);?/g, (_m, dec: string) => safeFromCodePoint(Number.parseInt(dec, 10)))
+        .replace(
+            /&(amp|lt|gt|quot|apos|colon|tab|newline);/gi,
+            (_m, name: string) => namedEntities[name.toLowerCase()] ?? _m,
+        );
+
+    // Strip whitespace and control characters (incl. NUL and DEL) that browsers
+    // ignore when resolving the scheme, then lowercase for comparison.
+    // biome-ignore lint/suspicious/noControlCharactersInRegex: intentionally matching the C0/DEL control chars browsers ignore when resolving a URL scheme, to block obfuscated-scheme bypasses.
+    return decoded.replace(/[\u0000-\u0020\u007f]+/g, '').toLowerCase();
 }
 
 /**

From 1b4be640c4c0d55231cc8c3bcbe4e24dfc30ad31 Mon Sep 17 00:00:00 2001
From: erseco <info@ernesto.es>
Date: Thu, 18 Jun 2026 17:09:06 +0100
Subject: [PATCH 3/3] fix(security): pin mindmaps CDN scripts
 (js/functionality-from-untrusted-source)

- jQuery 1.6.1 (ajax.googleapis.com): upgrade protocol-relative // to https and
  add Subresource Integrity (sha384, verified against the served bytes) plus
  crossorigin, matching the FileSaver.js tag fixed earlier in this PR.
- Filestack legacy loader: upgrade to https. Its URL is unversioned/mutable, so
  an SRI hash cannot be pinned without breaking on the next update; documented
  inline. This at least removes the protocol-downgrade vector.
---
 public/app/common/mindmaps/src/index.html | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/public/app/common/mindmaps/src/index.html b/public/app/common/mindmaps/src/index.html
index 4420554268..e33018f61f 100644
--- a/public/app/common/mindmaps/src/index.html
+++ b/public/app/common/mindmaps/src/index.html
@@ -231,8 +231,9 @@ <h2 class='image-description'>To download the map right-click the
     </div>
   </div>
 
-  <script src="//ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js"></script>
-  <script src="//api.filestackapi.com/filestack.js"></script>
+  <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js" integrity="sha384-n8WjrHJwg2HtuTVvw/b3de4eZQn0J7PNJXXHIQo7W5laymknFUgUF/3TUMmiWT7g" crossorigin="anonymous"></script>
+  <!-- Filestack's legacy loader is an unversioned, mutable endpoint, so a Subresource Integrity hash cannot be pinned without breaking on its next update; force https to remove the protocol-downgrade vector. -->
+  <script src="https://api.filestackapi.com/filestack.js" crossorigin="anonymous"></script>
   <script src="https://cdnjs.cloudflare.com/ajax/libs/FileSaver.js/1.3.3/FileSaver.min.js" integrity="sha512-DvLlX4EDfBZuesenAya2TOiF+cR7GbRsV+IElolKTYIj8JJHr9BFTcznTuRFabG26vcVsmDCcv2dL7m8Ov1XfA==" crossorigin="anonymous"></script>
 
   <!-- DEBUG -->