Stored CSS Injection in Open edX Email Digest via Unsanitized Thread Title: Analysis & Fix

Vulnerability Key Information Summary Vulnerability Overview Title: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title Type: Stored CSS Injection Root Cause: The function performs only limited processing of the attribute and does not apply full sanitization to , allowing user-controlled blocks within to survive during email digest rendering. Impact: - Stored email-open tracking (triggered on email open via or ) - Content spoofing / phishing (injecting pseudo-elements within content via / ) - Brand / trust damage (notification emails are visually tampered with) Scope of Impact Affected Versions: - (HEAD , 2026-06-15 17:46Z) - - - All release versions containing the application Trust Boundary: Student (enrolled learner) → Student (digest recipient); both are non-privileged roles, which fits the trust boundary definition. Affected Branches: - Introduced in (PR #4532 "feat: added daily and weekly email digest", 2024-05-07); present in all named release branches ( , , ). Unaffected Paths: The immediate email path ( ) uses to extract plain text, stripping blocks, and is therefore unaffected. Fix Options Two independent fix options are provided (choose one): Option A — Sanitize at the Digest Endpoint In , add a call to after : Option B (Recommended) — Unified Escaping at the Source In , apply HTML escaping to structured keys in : > Option B provides unified escaping at the source, protecting the Web notification API, the immediate email path, the digest email path, and all future renderers. It is the more structured fix. Key Code Paths (POC / Exploit Chain) Sink: (lines 210-219, 241) Source: (lines 405-407) Reach: (lines 65, 365) Render: (line 35) Data Flow (Exploit Chain) 1. Student Alice creates a thread via with the title 2. only performs without HTML escaping, writing the raw title to 3. Thread creation triggers , and the event carries 4. The digest scheduler (daily/weekly) invokes ; does not sanitize the block 5. Line 35 of the digest content renders , allowing the block to survive 6. A victim opens the email in Apple Mail / Outlook / Thunderbird, and the injected CSS takes effect References CVE: CVE-2026-42857 GHSA: GHSA-4xv3-5j4x-q8g4 (previously only partially fixed, not covering the path) Conclusion: The vulnerability is confirmed to exist on ( ).

Goal Reached Thanks to every supporter — we hit 100%!

Stored CSS Injection in Open edX Email Digest via Unsanitized Thread Title: Analysis & Fix

More from this source