Executive brief
Open edX Platform is a learning management system for hosting online courses. An enrolled student can inject CSS-capable markup into discussion post titles, which then appears in email notifications sent to other learners. When recipients open these digest or batched emails in a CSS-rendering email client, the injected CSS executes, enabling email tracking, content spoofing, and phishing attacks.
Technical details
The vulnerability is an unsanitized HTML injection in the notification content generation pipeline. User-controlled discussion post titles are passed through get_notification_content() in base_notification.py and rendered via Django's |safe filter in digest_content.html without HTML escaping, allowing CSS injection via style blocks. An authenticated enrolled student can exploit this via the discussion REST API, affecting digest and batched email renderers; the immediate-email path is unaffected due to separate sanitization logic.
Affected products
- edX Open edX Platform Redwood through Verawood
Timeline
- 2026-09-18: disclosed
- 2026-09-18: patched: Fixed in Ulmo and Verawood.1