CVE case study
CVE-2026-85271: Stored CSS Injection in Open edX Email Digests via an Unsanitized Thread Title
Open edX Platform from the Redwood release onward built email digest and batched notification content by substituting the raw discussion thread title into an HTML template with no escaping and without the sanitizer added by the earlier CVE-2026-42857 fix, so any enrolled student could store a thread title carrying CSS that rendered in digest emails sent to other learners. The Ulmo and Verawood security releases close the digest path.
- Weakness
- CWE-79
- Affected
- Open edX Platform, Redwood release onward, before the fix commits on master, release/ulmo and release/verawood
- Remediation state
- Upgrade to a patched Ulmo or Verawood release
- Advisory published
- 17 Jul 2026
Official vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Why it matters
Open edX sends discussion notifications by email in two ways: an immediate message, and a daily or weekly digest whose code also serves batched emails. The earlier advisory GHSA-4xv3-5j4x-q8g4, CVE-2026-42857, fixed stored CSS injection in the immediate path by stripping style tags from the post body. The digest path never called that sanitizer: it built its content from a template that substituted the raw thread title through Python string formatting and rendered the result with Django's safe filter, so the title bypassed every escape.
Any enrolled student can set a thread title, so any student could plant CSS that rendered in the digest emails of every other learner who followed or replied to the thread. In mail clients that honor CSS, that allows email-open tracking through background-image or @import requests that leak the reader's IP address and client, and content spoofing or phishing by hiding the legitimate notification cards and injecting attacker-controlled text. The trust boundary is student to student, the same one the prior advisory accepted, and the public record scores it Medium at 6.1 with changed scope.
The maintainers confirmed the path on master and traced it to the digest feature introduced in May 2024, so every named release from Redwood onward carried it, and they patched master, release/ulmo and release/verawood. I reported two fixes and recommended escaping every user-controlled template variable at the source rather than sanitizing one renderer, because that single change covers the web notification API, the immediate email, the digest and the batched email at once. The broader lesson is that a sanitizer bolted onto one sink leaves every other sink open.