CVE-2026-42857

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-42857", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-30T16:44:48.379Z", "datePublished": "2026-05-11T17:32:40.940Z", "dateUpdated": "2026-05-13T14:40:55.961Z"}, "containers": {"cna": {"title": "Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4"}, {"name": "https://github.com/openedx/openedx-platform/commit/cddc25cd791bb78f76833896e4778f668861df12", "tags": ["x_refsource_MISC"], "url": "https://github.com/openedx/openedx-platform/commit/cddc25cd791bb78f76833896e4778f668861df12"}], "affected": [{"vendor": "openedx", "product": "openedx-platform", "versions": [{"version": "< cddc25cd791bb78f76833896e4778f668861df12", "status": "affected"}, {"version": ">= sumac, < ulmo", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-11T17:32:40.940Z"}, "descriptions": [{"lang": "en", "value": "Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove <style> tags from user-generated discussion post content. This content is rendered with Django's |safe template filter in email notification templates, allowing any enrolled student to inject arbitrary CSS into email notifications sent to other users. This enables email tracking (IP address disclosure), content spoofing, and phishing attacks. This vulnerability is fixed with commit cddc25cd791bb78f76833896e4778f668861df12."}], "source": {"advisory": "GHSA-4xv3-5j4x-q8g4", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-13T12:50:59.990504Z", "id": "CVE-2026-42857", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T14:40:55.961Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-42857", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T12:50:59.990504Z"}}}], "references": [{"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T12:51:16.760Z"}}], "cna": {"title": "Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization", "source": {"advisory": "GHSA-4xv3-5j4x-q8g4", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "openedx", "product": "openedx-platform", "versions": [{"status": "affected", "version": "< cddc25cd791bb78f76833896e4778f668861df12"}, {"status": "affected", "version": ">= sumac, < ulmo"}]}], "references": [{"url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4", "name": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openedx/openedx-platform/commit/cddc25cd791bb78f76833896e4778f668861df12", "name": "https://github.com/openedx/openedx-platform/commit/cddc25cd791bb78f76833896e4778f668861df12", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove <style> tags from user-generated discussion post content. This content is rendered with Django's |safe template filter in email notification templates, allowing any enrolled student to inject arbitrary CSS into email notifications sent to other users. This enables email tracking (IP address disclosure), content spoofing, and phishing attacks. This vulnerability is fixed with commit cddc25cd791bb78f76833896e4778f668861df12."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-11T17:32:40.940Z"}}}, "cveMetadata": {"cveId": "CVE-2026-42857", "state": "PUBLISHED", "dateUpdated": "2026-05-13T14:40:55.961Z", "dateReserved": "2026-04-30T16:44:48.379Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-11T17:32:40.940Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openedx-platform", "vendor": "openedx", "versions": [{"status": "affected", "version": "< cddc25cd791bb78f76833896e4778f668861df12"}, {"status": "affected", "version": ">= sumac, < ulmo"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openedx:openedx:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6A89836-9BC9-44BF-B3FD-D1767F42B02D", "versionEndExcluding": "2026-04-24", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove <style> tags from user-generated discussion post content. This content is rendered with Django's |safe template filter in email notification templates, allowing any enrolled student to inject arbitrary CSS into email notifications sent to other users. This enables email tracking (IP address disclosure), content spoofing, and phishing attacks. This vulnerability is fixed with commit cddc25cd791bb78f76833896e4778f668861df12."}, {"lang": "es", "value": "La Plataforma Open edX permite la creaci\u00f3n y entrega de aprendizaje en l\u00ednea a cualquier escala. El saneador HTML clean_thread_html_body() utilizado para los correos electr\u00f3nicos de notificaci\u00f3n de discusi\u00f3n no logra eliminar las etiquetas [style] del contenido de publicaciones de discusi\u00f3n generado por el usuario. Este contenido se renderiza con el filtro de plantilla |safe de Django en las plantillas de notificaci\u00f3n por correo electr\u00f3nico, permitiendo a cualquier estudiante matriculado inyectar CSS arbitrario en las notificaciones por correo electr\u00f3nico enviadas a otros usuarios. Esto permite el seguimiento de correo electr\u00f3nico (divulgaci\u00f3n de direcci\u00f3n IP), la suplantaci\u00f3n de contenido y ataques de phishing. Esta vulnerabilidad se corrige con el commit cddc25cd791bb78f76833896e4778f668861df12."}], "id": "CVE-2026-42857", "lastModified": "2026-10-26T18:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42857", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-13T12:50:59.990504Z", "version": "2.0.3"}}]}, "published": "2026-05-11T18:16:36.130", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openedx/openedx-platform/commit/cddc25cd791bb78f76833896e4778f668861df12"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,cddc25cd791bb78f76833896e4778f668861df12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[sumac,ulmo)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openedx-platform", "source": "cna", "vendor": "openedx"}, "product": "openedx-platform", "vendor": "openedx"}], "created": "2026-05-11T19:30:06.024631+00:00", "updated": "2026-05-11T19:30:06.306890+00:00", "vendors": ["openedx", "openedx$PRODUCT$openedx-platform"]}