CVE-2026-31281 Cross-site scripting in n/a
Attackers can inject malicious HTML into Totara LMS messages, potentially leading to session hijacking and browser-based command execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-31281?
CVE-2026-31281 is a high-severity cross-site scripting vulnerability in n/a, published on 13 Apr 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Totara LMS v19.1.5 and before is vulnerable to HTML Injection. An attacker can inject malicious HTML code in a message and send it to all the users in the application, resulting in executing the code and may lead to session hijacking and executing commands on the victim's browser. NOTE: The supplier states that the product name is Totara Learning and that the functionality referenced is the in app messaging client. They note that the in app messaging client only has the ability to embed a specific allowed list of HTML tags commonly used for text enhancement, which includes italic, bold, underline, strong, etc. Last, they state that the in app messaging client cannot embed <script>, <style>, <iframe>, <object>, <embed>, <form>, <input>, <button>, <svg>, <math>, etc., and any attempt to embed tags or attributes outside of the allowed list (including onerror, onaction, etc.) is sanitized via DOMPurify.
Weakness: CWE-79
Which versions are affected by CVE-2026-31281?
How do I fix CVE-2026-31281?
No fix has been published for CVE-2026-31281 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-31281 being exploited?
There is no known exploitation of CVE-2026-31281 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-8rvg-748c-85h2.