CVE-2026-85271

Name of the Vulnerable Software and Affected Versions Open edX Platform versions Redwood through Ulmo and Verawood.1

Description The add additional attributes to notifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-title values produced by get notification content in openedx/core/djangoapps/notifications/base notification.py. An enrolled student can inject CSS-capable markup into the post title value supplied by lms/djangoapps/discussion/rest api/discussions notifications.py. During digest and batched-email rendering, this value is processed through openedx/core/djangoapps/notifications/templates/notifications/digest content.html as safe HTML. This allows for email-open tracking, content spoofing, or phishing when another learner uses a CSS-rendering client.

Recommendations Update to Ulmo or Verawood.1.