What is the CVSS score of EUVD-2026-29165?

EUVD-2026-29165 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Open edX Platform EUVD-2026-29165

| CVE-2026-42857 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-11 GitHub_M

XSS Python

4.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.6 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 11, 2026 - 18:47 vuln.today

Analysis Generated

May 11, 2026 - 18:47 vuln.today

CVE Published

May 11, 2026 - 17:32 nvd

MEDIUM 4.6

DescriptionGitHub Advisory

Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove <style> tags from user-generated discussion post content. This content is rendered with Django's |safe template filter in email notification templates, allowing any enrolled student to inject arbitrary CSS into email notifications sent to other users. This enables email tracking (IP address disclosure), content spoofing, and phishing attacks. This vulnerability is fixed with commit cddc25cd791bb78f76833896e4778f668861df12.

AnalysisAI

Stored cross-site scripting (XSS) via CSS injection in Open edX Platform allows enrolled students to inject arbitrary CSS into discussion notification emails sent to other users by bypassing insufficient HTML sanitization in the clean_thread_html_body() function. The vulnerability affects all versions prior to the fix commit and enables email tracking through malicious stylesheets, content spoofing, and phishing attacks against recipients who view notification emails.

Technical ContextAI

The vulnerability exists in the discussion notification email rendering pipeline of Open edX Platform. The clean_thread_html_body() function in lms/djangoapps/discussion/rest_api/discussions_notifications.py is responsible for sanitizing user-generated HTML content from discussion posts before it is rendered in email templates. However, this function fails to remove <style> tags, which are then rendered with Django's |safe template filter in email notification templates. When recipients open the email, the browser interprets the arbitrary CSS, allowing attackers to exploit CSS capabilities such as background-image URLs to exfiltrate IP addresses (via DNS/HTTP requests to attacker-controlled domains), overlay phishing forms using absolute positioning, or perform visual content spoofing. The root cause is incomplete HTML tag stripping (CWE-79: Improper Neutralization of Input During Web Page Generation). The fix (commit cddc25cd791bb78f76833896e4778f668861df12) adds <style> tag decomposition logic alongside content removal to fully eliminate CSS injection vectors.

RemediationAI

Apply the upstream fix by updating Open edX Platform to a patched version that includes commit cddc25cd791bb78f76833896e4778f668861df12 or later. The fix adds <style> tag decomposition to the clean_thread_html_body() function in lms/djangoapps/discussion/rest_api/discussions_notifications.py. If immediate patching is not feasible, implement compensating controls: (1) Disable or restrict the HTML discussion feature in notification emails by rendering discussion content as plain text instead of HTML, which eliminates CSS injection vectors at the rendering layer but may reduce email formatting quality. (2) Implement a Content Security Policy (CSP) header in email clients or email gateway settings that blocks inline styles (style-src 'none'), though this depends on email client support and may not be universally enforced. (3) Audit discussion posts for suspicious <style> tags in the discussion moderation tools and remove flagged posts; this is reactive but identifies active exploitation. (4) Restrict discussion posting privileges to trusted users (instructors, teaching assistants) rather than all enrolled students if pedagogically acceptable, reducing the attacker population. Refer to GitHub commit https://github.com/openedx/openedx-platform/commit/cddc25cd791bb78f76833896e4778f668861df12 for implementation details and test cases.