CVE-2026-85271: Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)
Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-title values produced by getnotificationcontent in openedx/core/djangoapps/notifications/basenotification.py. An enrolled student can place CSS-capable markup in the posttitle value supplied by lms/djangoapps/discussion/restapi/discussionsnotifications.py. Digest and batched-email rendering then passes that value through openedx/core/djangoapps/notifications/templates/notifications/digestcontent.html as safe HTML, allowing email-open tracking and content spoofing or phishing when another learner opens a CSS-rendering client. The immediate-email path is not affected because it strips title markup and renders a separately sanitized body. This issue is fixed in Ulmo and Verawood.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open edX Platform (openedx) - Ulmo and Verawood.1to a version that resolves this vulnerability.Fixed in Ulmo and Verawood.1
Event History
Frequently Asked Questions
Which notification delivery modes are affected?
Digest and batched-email rendering are affected because they pass discussion titles through as safe HTML. Immediate-email notifications are not affected because they strip title markup and use a separately sanitized body.
What access does an attacker need to exploit this?
An attacker needs to be an enrolled student who can supply CSS-capable markup in a discussion post title. Exploitation also requires another learner to open the resulting email in a client that renders the CSS.
What could a successful exploit enable?
The injected CSS can be used for email-open tracking and for spoofed or phishing content in affected digest or batched notification emails. The vulnerability does not provide a stated availability impact.
Which releases should be remediated?
The issue affects Open edX Platform releases from Redwood until the fixes in Ulmo and Verawood.1. Updating to Ulmo or Verawood.1 addresses the issue.