The Open edX Platform enables online learning at scale and includes a discussion notification feature that sends emails to users. The vulnerability exists because the HTML sanitizer clean_thread_html_body() fails to remove <style> tags from user-generated content in discussion posts. Since this content is rendered with Django's |safe filter in email templates, it allows any enrolled student to inject arbitrary CSS into emails sent to other users. This CSS injection can be exploited for email tracking (disclosing IP addresses), content spoofing, and phishing. The vulnerability affects versions prior to commit cddc25cd791bb78f76833896e4778f668861df12 and is fixed by that commit.

The vulnerability allows an attacker who is an enrolled student to inject arbitrary CSS into email notifications sent to other users. This can be used to track recipients' IP addresses, spoof email content, and facilitate phishing attacks. The confidentiality and integrity of email communications are impacted, but there is no indication of availability impact. The CVSS score is 4.6 (medium severity), reflecting limited impact on confidentiality and integrity with no impact on availability.

A fix is available and implemented in commit cddc25cd791bb78f76833896e4778f668861df12. Users of the Open edX Platform should update to this commit or a later version that includes this fix to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.