CVE-2026-42857: Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization
Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer cleanthreadhtmlbody() used for discussion notification emails fails to remove <style> tags from user-generated discussion post content. This content is rendered with Django's |safe template filter in email notification templates, allowing any enrolled student to inject arbitrary CSS into email notifications sent to other users. This enables email tracking (IP address disclosure), content spoofing, and phishing attacks. This vulnerability is fixed with commit cddc25cd791bb78f76833896e4778f668861df12.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42857?
CVE-2026-42857 is classified as a medium severity vulnerability due to the potential for stored CSS injection in email notifications.
How do I fix CVE-2026-42857?
To mitigate CVE-2026-42857, it is recommended to upgrade to the latest version of Open edX Platform where the vulnerability is patched.
What are the consequences of CVE-2026-42857?
If exploited, CVE-2026-42857 could allow attackers to inject malicious CSS into email notifications, potentially leading to phishing attacks.
Which versions of Open edX are affected by CVE-2026-42857?
Open edX Platform versions prior to April 24, 2026, are vulnerable to CVE-2026-42857.
How does CVE-2026-42857 affect email notifications?
CVE-2026-42857 allows for the inclusion of unfiltered <style> tags in email notifications, leading to potential CSS injection vulnerabilities.