The Open edX platform's discussion notification emails use the clean_thread_html_body() sanitizer to process user-generated discussion posts. However, this sanitizer does not remove <style> tags, and the content is rendered with Django's |safe filter in email templates. This improper neutralization of input (CWE-79) allows any enrolled student to inject arbitrary CSS into notification emails, which can be used for email tracking (disclosing recipient IP addresses), content spoofing, and phishing. The issue affects versions prior to commit cddc25cd791bb78f76833896e4778f668861df12 and has been fixed in that commit.

The vulnerability allows attackers with enrolled student privileges to inject arbitrary CSS into email notifications sent to other users. This can lead to privacy breaches through email tracking (IP address disclosure), as well as enable content spoofing and phishing attacks via manipulated email content. There is no indication of direct code execution or system compromise. The CVSS 3.1 base score is 4.6, reflecting a medium severity impact with limited confidentiality and integrity impact and no availability impact.

A fix for this vulnerability is available and has been implemented in commit cddc25cd791bb78f76833896e4778f668861df12. Users of the Open edX platform should update to this commit or a later version that includes the fix. There is no vendor advisory explicitly provided, but the commit reference confirms the availability of an official fix. No additional mitigation steps are indicated.