PT-2026-39712 · Unknown · Open Edx Platform

Ik0Z · Published 2026-05-11 · Updated 2026-05-11 · CVE-2026-42857

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Open edX Platform (affected versions not specified)

Description The HTML sanitizer function clean thread html body() used for discussion notification emails fails to remove <style> tags from user-generated discussion post content. Because this content is rendered using Django's |safe template filter in email notification templates, an enrolled student can inject arbitrary CSS into emails sent to other users. This can lead to content spoofing, phishing attacks, and email tracking, which may disclose IP addresses.

Recommendations Apply the fix provided in commit cddc25cd791bb78f76833896e4778f668861df12.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42857

GHSA-4XV3-5J4X-Q8G4

Affected Products

Open Edx Platform

References · 6

• 🔥 https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42857.json · Exploit
• https://github.com/openedx/openedx-platform/commit/cddc25cd791bb78f76833896e4778f668861df12 · Patch
• https://osv.dev/vulnerability/CVE-2026-42857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42857 · Security Note
• https://twitter.com/CVEnew/status/2053932399223030229 · Twitter Post