Open edX Platform CVE-2026-85271

Requires an attacker enrolled as a student in a course who can submit a discussion post_title (via lms/djangoapps/discussion/rest_api/discussions_notifications.py). The target must have digest or batched email notifications enabled - the immediate-email path is NOT affected because it strips title markup and renders a separately sanitized body. Exploitation further requires a victim (another learner) to open the resulting notification email in an email client that renders CSS/HTML. Limiting factors: course enrollment/authentication of the poster, victim user interaction (opening the email), the non-default reliance on digest/batched (not immediate) email delivery, and impact bounded to tracking/spoofing/phishing rather than code execution. Applies to Open edX from Redwood up to (not including) Ulmo and Verawood.1.

Real-world risk is moderate-to-low despite the 6.1 vendor CVSS. All exploitation signals point to a low-urgency issue: no EPSS score, not in CISA KEV, and no public exploit code (no public exploit identified at time of analysis). The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows only Low confidentiality and Low integrity impact with no availability effect, and requires victim user interaction (UI:R - a second learner must open a digest/batched email in a CSS-rendering client). A key data conflict exists: the vector lists PR:N (unauthenticated), but the description states the injecting party must be 'an enrolled student' who can place markup in a discussion post_title - that is a course-enrolled, authenticated actor, so PR:L is more defensible. Also note the impact class is overstated in name: CWE-79 tags this XSS, but the source-code fix and description show it is HTML/CSS injection into email (email clients do not execute JavaScript), enabling email-open tracking, content spoofing and phishing - not script execution or session theft. Bottom line: legitimate to patch on a normal cycle, but not an emergency; the phishing/tracking payoff and required enrollment + victim email-open make it a targeted-abuse issue rather than a mass-exploitable one.

An enrolled student creates or edits a discussion thread whose title contains CSS-capable markup (e.g. a <style> block or tracking-styled element). When the platform generates digest or batched-email notifications, the unsanitized post_title is rendered as safe HTML in digest_content.html, so when another learner opens the email in a CSS-rendering client the injected markup fires - enabling email-open tracking, visual content spoofing, or a phishing lure. No public exploit code exists, but the fix commit and regression tests concretely demonstrate the injection payloads.