Executive brief
Open edX is an online learning platform used to deliver educational content at scale. A vulnerability in the platform's discussion notification system allows students to inject malicious styling code into emails sent to other users. This can be used to track when a user opens an email, reveal their IP address, or display fake messages to trick users into visiting phishing websites.
Technical details
The HTML sanitizer 'clean_thread_html_body()' in 'lms/djangoapps/discussion/rest_api/discussions_notifications.py' fails to include the <style> tag in its denylist. Because the sanitized content is subsequently rendered using Django's '|safe' template filter, arbitrary CSS rules provided by a student in a discussion post are included in email notifications sent to other users. An attacker can use CSS features like 'background-image' or '@import' to track email opens and disclose victim IP addresses, or use pseudo-elements (::before/::after) and 'display: none' to spoof email content for phishing. The vulnerability is fixed by ensuring <style> tags and their contents are decomposed during sanitization.
Affected products
- Open edX openedx-platform >=sumac
Timeline
- 2026-04-24: advisory: GitHub Security Advisory GHSA-4xv3-5j4x-q8g4 published
- 2026-05-11: disclosed: CVE-2026-42857 published to NVD
- 2026-05-11: patched: Fix committed to master branch