Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-title values produced by get_notification_content in openedx/core/djangoapps/notifications/base_notification.py. An enrolled student can place CSS-capable markup in the post_title value supplied by lms/djangoapps/discussion/rest_api/discussions_notifications.py. Digest and batched-email rendering then passes that value through openedx/core/djangoapps/notifications/templates/notifications/digest_content.html as safe HTML, allowing email-open tracking and content spoofing or phishing when another learner opens a CSS-rendering client. The immediate-email path is not affected because it strips title markup and renders a separately sanitized body. This issue is fixed in Ulmo and Verawood.1.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-19 | 1 | General1 |
| 2026-09-27 | 1 | Disclosure1 |
CVE-2026-85271 Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_notific… https://www.cve.org/CVERecord?id=CVE-2026-85271
Post summary
The post mentions CVE-2026-85271 but contains no information about PoC, exploit code, active exploitation, patches, or technical vulnerability details, resulting in a general classification.
CVE-2026-85271 Open edX: unsanitized discussion titles let enrolled students inject CSS-capable markup into notification emails. CVSS 6.1. No patch yet. Restrict enrollment or filter post_title. Details: https://www.valtersit.com/cve/CVE-2026-85271/ #CVE #infosec #OpenEdX #OpenedX #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
Post summary
The post discloses a previously undisclosed vulnerability (CVE-2026-85271) in Open edX involving unsanitized discussion titles leading to XSS-like CSS injection, with a CVSS score of 6.1 and a link to further details.