CVE-2026-42857

Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove <style> tags from user-generated discussion post content. This content is rendered with Django's |safe template filter in email notification templates, allowing any enrolled student to inject arbitrary CSS into email notifications sent to other users. This enables email tracking (IP address disclosure), content spoofing, and phishing attacks. This vulnerability is fixed with commit cddc25cd791bb78f76833896e4778f668861df12.

• CWE-79

• https://github.com/openedx/openedx-platform/commit/cddc25cd791bb78f76833896e4778f668861df12Patch
• https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4Exploit, Vendor Advisory
• https://github.com/openedx/openedx-platform/security/advisories/GHSA-4xv3-5j4x-q8g4Exploit, Vendor Advisory

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42850Kitty is a cross-platform GPU based terminal. In versions pr…8.8
• CVE-2026-42851Kitty is a cross-platform GPU based terminal. In versions pr…7.8
• CVE-2026-42853ApostropheCMS is an open-source Node.js content management s…6.5
• CVE-2026-42854arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ES…9.8
• CVE-2026-42855arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ES…7.5
• CVE-2026-42856Network-AI is a TypeScript/Node.js multi-agent orchestrator.…8.7
• CVE-2026-42858Open edX Platform enables the authoring and delivery of onli…9.9
• CVE-2026-42859Neat VNC is a VNC server library. Prior to 0.9.6, a pre-auth…8.1
• CVE-2026-4286Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fa…4.3
• CVE-2026-42860The Open edx Enterprise Service app provides enterprise feat…8.5
• CVE-2026-42861Flowise is a drag & drop user interface to build a customize…9.6
• CVE-2026-42862Flowise is a drag & drop user interface to build a customize…5