The Open edX Platform’s HTML sanitizer fails to strip <style> tags from user‑generated discussion posts. Those posts are rendered with Django’s |safe template filter inside email notification templates, allowing any enrolled student to inject arbitrary CSS into email notifications sent to other users. The injected CSS can be used for email tracking, including revealing the recipient’s IP address, and can also modify the appearance of legitimate content to facilitate phishing and content spoofing attacks.

The affected vendor is openedx and the product is the Open edX Platform. No specific product versions are listed in the advisory; however, any installation that has not applied the fix implemented by commit cddc25cd791bb78f76833896e4778f668861df12 is vulnerable.

The CVSS score of 4.6 indicates moderate overall severity. The EPSS score is not available, and the vulnerability is not included in the CISA KEV catalog. Based on the description, the likely attack vector is internal: any enrolled student can author a discussion post containing malicious CSS, and that CSS will be sent to other users through email notifications. The exploitation requires no special privileges beyond normal platform participation, making the vulnerability relatively approachable for an attacker with access to the learning platform.