Open edX Platform versions from Redwood up to but not including Ulmo and Verawood.1 contain a cross-site scripting vulnerability (CWE-79) in the email notification system. Specifically, the add_additional_attributes_to_notifications function assigns notification content without sanitizing discussion-title values, which can contain CSS-capable markup supplied by enrolled students. This markup is rendered as safe HTML in digest and batched emails, allowing attackers to perform email-open tracking and spoof content or phishing attacks when other learners open these emails. Immediate email notifications are not vulnerable due to separate sanitization of the title. The vulnerability is addressed in the Ulmo and Verawood.1 versions.

An attacker who is an enrolled student can inject malicious CSS-capable markup into discussion post titles, which are then included unsanitized in digest and batched email notifications. This can lead to email-open tracking and content spoofing or phishing attacks against other learners who receive these emails. The vulnerability does not affect immediate email notifications. The CVSS 3.1 score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impact.

This vulnerability is fixed in the Ulmo and Verawood.1 releases of Open edX Platform. Users should upgrade to at least these versions to remediate the issue. No other mitigation is indicated or required as the fix addresses the root cause by sanitizing discussion-title values in notification emails.