CVE-2026-85271 Cross-site scripting in openedx-platform
An attacker can inject CSS into email digests via unsanitized thread titles, enabling tracking and phishing when victims open emails in CSS-rendering clients.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-85271?
CVE-2026-85271 is a medium-severity cross-site scripting vulnerability in openedx-platform, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the add_additional_attributes_to_notifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-title values produced by get_notification_content in openedx/core/djangoapps/notifications/base_notification.py. An enrolled student can place CSS-capable markup in the post_title value supplied by lms/djangoapps/discussion/rest_api/discussions_notifications.py. Digest and batched-email rendering then passes that value through openedx/core/djangoapps/notifications/templates/notifications/digest_content.html as safe HTML, allowing email-open tracking and content spoofing or phishing when another learner opens a CSS-rendering client. The immediate-email path is not affected because it strips title markup and renders a separately sanitized body. This issue is fixed in Ulmo and Verawood.1.
Weakness: CWE-79
Which versions are affected by CVE-2026-85271?
How do I fix CVE-2026-85271?
No fix has been published for CVE-2026-85271 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-85271 being exploited?
There is no known exploitation of CVE-2026-85271 in the wild and no public exploit code.
Sources
Also known as GHSA-rv5w-f4r5-h77g.