Wednesday, January 28, 2026
1 change · 18.0
Resolved issues and error corrections
This update fixes a security vulnerability where customer emails with shorthand background styles were being stripped, potentially leading to styling issues. The team implemented a solution using a specialized tool to correctly interpret and sanitize background styles in emails, ensuring consistent and secure email rendering.
Original PR description
Issue: When the customer sends an email with shorthand background it stripes the styling.
"background" isnt being striped into their longhand terms for xss.
Fix: I am using https://pypi.org/project/tinycss2/ to tokinize and identify the longhand terms inside the background shorthand and replace them with the longhand terms.
opw-5391098
---
I confirm I have signed the CLA and read the PR guidelines at www.odoo.com/submit-pr