The flaw in RELATE arises from the ParticipationAdmin.get_user() method rendering user supplied first and last names with Django's mark_safe and string formatting, bypassing all HTML escaping. Because any authenticated, enrolled student can freely edit these fields through their profile page, an attacker can store malicious JavaScript. When an administrator opens the Participation list, the stored payload executes in the administrator’s browser, giving the attacker full control of the admin account. This stored cross‑site scripting flaw is identified as CWE‑79 and can compromise both confidentiality and integrity of the courseware system.

All RELATE deployments that run the codebase prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 are affected. The vendor is inducer:relate and the product is the RELATE web‑based courseware. Upgrading to the referenced commit or any newer release that incorporates the change removes the vulnerability.

The CVSS score of 8.7 signals very high severity, and the flaw enables an attacker with ordinary user privileges to achieve a full admin takeover. No public exploitation is currently catalogued in KEV and the EPSS score is not available, yet the attack path is straightforward: an enrolled user modifies their profile name, the data is stored, and an admin viewing the participation list triggers the script. Until the patch is applied, the risk remains high for any instance of RELATE that has not yet updated to the fixed commit.