Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-85271— Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)

Quick assessment

Affected
openedx openedx-platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Open edX 平台支持任意规模的网络课程创建与交付。从 Redwood 版本直至 Ulmo 版本以及 Verawood.1 版本之前，位于 中的 函数在分配通知内容时，未对由 中 函数生成的 值进行任何净化处理。已注册的学生可以在 提供的 字段中插入具备 CSS 能力的标记内容。随后，摘要邮件和批量邮件的渲染流程会通过 模板将该值作为“安全 HTML”直接输出，从而在另一名学习者使用支持 CSS 渲染的邮件客户端打开该邮件时，可能被利用以实现邮件打开追踪、内容伪造或钓鱼攻击。即时邮件发送路径不受此问题影响，因为

CVSS 6.1 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-85271

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)
Source: CVE Program / CVE List V5
Vulnerability Description
Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-title values produced by get_notification_content in openedx/core/djangoapps/notifications/base_notification.py. An enrolled student can place CSS-capable markup in the post_title value supplied by lms/djangoapps/discussion/rest_api/discussions_notifications.py. Digest and batched-email rendering then passes that value through openedx/core/djangoapps/notifications/templates/notifications/digest_content.html as safe HTML, allowing email-open tracking and content spoofing or phishing when another learner opens a CSS-rendering client. The immediate-email path is not affected because it strips title markup and renders a separately sanitized body. This issue is fixed in Ulmo and Verawood.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
openedx openedx-platform >= release/redwood.1, < release/ulmo.4 -

II. Public POCs for CVE-2026-85271

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-85271

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-85271 (3)

Other References for CVE-2026-85271 (3)

IV. Related Vulnerabilities

Same product: openedx-platform
Same vendor: openedx
Same weakness: CWE-79

V. Comments for CVE-2026-85271

No comments yet

Leave a comment