The RELATE courseware package versions before commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 contain a stored XSS vulnerability (CWE-79). The vulnerability is due to the ParticipationAdmin's get_user() method rendering user input with mark_safe and Python string formatting, bypassing Django's automatic HTML escaping. Since first_name and last_name fields are editable by any authenticated user without sanitization, malicious scripts can be injected and executed when an admin views the Participation list in the Django admin interface. The commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 addresses this issue by properly sanitizing the input.

An authenticated user (enrolled student) can inject arbitrary JavaScript into their profile fields, which executes in the browser of an administrator viewing the Participation list. This can lead to full administrative account takeover, compromising confidentiality and integrity of the system. The CVSS score is 8.7 (high severity) with network attack vector, low attack complexity, required privileges of an authenticated user, user interaction required, scope change, and high impact on confidentiality and integrity.

A fix is available in commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 which properly sanitizes user input to prevent XSS. Users of RELATE should upgrade to this commit or a later version that includes this fix. No vendor advisory was provided, so patch status is based on the commit information. Until patched, restrict profile editing or admin access as a temporary measure.