CVE-2026-42857

{
  "id": "CVE-2026-42857",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-11T18:16:36.130",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove <style> tags from user-generated discussion post content. This content is rendered with Django's |safe template filter in email notification templates, allowing any enrolled student to inject arbitrary CSS into email notifications sent to other users. This enables email tracking (IP address disclosure), content spoofing, and phishing attacks. This vulnerability is fixed with commit cddc25cd791bb78f76833896e4778f668861df12."
    },
    {
      "lang": "es",
      "value": "La Plataforma Open edX permite la creación y entrega de aprendizaje en línea a cualquier escala. El saneador HTML clean_thread_html_body() utilizado para los correos electrónicos de notificación de discusión no logra eliminar las etiquetas [style] del contenido de publicaciones de discusión generado por el usuario. Este contenido se renderiza con el filtro de plantilla |safe de Django en las plantillas de notificación por correo electrónico, permitiendo a cualquier estudiante matriculado inyectar CSS arbitrario en las notificaciones por correo electrónico enviadas a otros usuarios. Esto permite el seguimiento de correo electrónico (divulgación de dirección IP), la suplantación de contenido y ataques de phishing. Esta vulnerabilidad se corrige con el commit cddc25cd791bb78f76833896e4778f668861df12."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "openedx",
          "product": "openedx-platform",
          "versions": [
            {
              "version": "< cddc25cd791bb78f76833896e4778f668861df12",
              "status": "affected"
            },
            {
              "version": ">= sumac, < ulmo",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 2.5
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T12:50:59.990504Z",
          "id": "CVE-2026-42857",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:openedx:openedx:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2026-04-24",
              "matchCriteriaId": "B6A89836-9BC9-44BF-B3FD-D1767F42B02D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/openedx/openedx-platform/commit/cddc25cd791bb78f76833896e4778f668861df12",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}