A security patch for openedx/edx-platform will be added to the Ulmo and Verawood releases and to the current github master branch around 2026-09-15T14:00:00Z.
It will fix one security defect with a “critical” CVSS 3.1 severity rating.
Details will be published here after release: GitHub security advisory
The publish was slightly delayed but the advisory is now public and links to the relevant commit. This change comes with a waffle flag to disable it as it may have negative impacts on course content served from the contentserver. If you run into any issues you can use the course_assets.allow_unsafe_asset_rendering course waffle flag to disable the fix on a course or org basis.
I recommend only doing this temporarily while the broken content is migrated somewhere else.