Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-85271— Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Quick assessment

Affected
openedx openedx-platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Open edX 平台支持在线学习课程的制作与分发，适用于各种规模的平台。在 Redwood 版本中，以及从 Ulmo 之前的版本直到 Verawood.1 之前， 中的 函数在未对 （位于 ）生成的讨论标题值进行消毒处理的情况下，直接将其分配给通知内容。已注册的学生可以在由 提供的 值中嵌入支持 CSS 的标记。摘要邮件和批量邮件的渲染流程随后会将该值通过 作为安全的 HTML 传递，当其他学习者使用支持 CSS 渲染的邮件客户端打开邮件时，就可能引发邮件打开追踪、内容伪造或钓鱼攻击。即时邮件路径不受影响，因为它

CVSS 6.1 · Medium EPSS 0.35% · P29

Affected Version Matrix 1

VendorProduct Version RangeStatus
openedx openedx-platform >= release/redwood.1, < release/ulmo.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85271

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)
Source: CVE Program / CVE List V5
Vulnerability Description
Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-title values produced by get_notification_content in openedx/core/djangoapps/notifications/base_notification.py. An enrolled student can place CSS-capable markup in the post_title value supplied by lms/djangoapps/discussion/rest_api/discussions_notifications.py. Digest and batched-email rendering then passes that value through openedx/core/djangoapps/notifications/templates/notifications/digest_content.html as safe HTML, allowing email-open tracking and content spoofing or phishing when another learner opens a CSS-rendering client. The immediate-email path is not affected because it strips title markup and renders a separately sanitized body. This issue is fixed in Ulmo and Verawood.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
openedx openedx-platform >= release/redwood.1, < release/ulmo.4 -

II. Public POCs for CVE-2026-85271

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85271

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-85271 (3)

Other References for CVE-2026-85271 (3)

IV. Related Vulnerabilities

Same product: openedx-platform
Same vendor: openedx
Same weakness: CWE-79