CVE-2026-31281

High

Published: 13 April 2026

Published

13 April 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0004 12.7th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-31281 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Totara LMS (inferred from references). Its CVSS base score is 8.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 12.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to JavaScript (T1059.007) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-15 Information Output Filtering good match

prevent

Filters output in the in-app messaging client to prevent injected malicious HTML from executing in victims' browsers.

SI-10 Information Input Validation good match

prevent

Validates and sanitizes HTML inputs to the messaging system to block malicious code injection by low-privilege users.

SI-9 Information Input Restrictions partial match

prevent

Restricts message inputs to only the approved list of safe HTML tags and attributes, enhancing sanitization efforts.

MITRE ATT&CK Enterprise TechniquesAI

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

T1539 Steal Web Session Cookie Credential Access

An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

attack.mitre.org →

Why these techniques?

Stored HTML injection/XSS in the authenticated in-app messaging feature directly enables arbitrary JavaScript execution in victim browsers (T1059.007) and the explicitly described session hijacking via stolen cookies or hijacked sessions (T1185, T1539).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Totara LMS v19.1.5 and before is vulnerable to HTML Injection. An attacker can inject malicious HTML code in a message and send it to all the users in the application, resulting in executing the code and may lead to session…

hijacking and executing commands on the victim's browser. NOTE: The supplier states that the product name is Totara Learning and that the functionality referenced is the in app messaging client. They note that the in app messaging client only has the ability to embed a specific allowed list of HTML tags commonly used for text enhancement, which includes italic, bold, underline, strong, etc. Last, they state that the in app messaging client cannot embed <script>, <style>, <iframe>, <object>, <embed>, <form>, <input>, <button>, <svg>, <math>, etc., and any attempt to embed tags or attributes outside of the allowed list (including onerror, onaction, etc.) is sanitized via DOMPurify.

Deeper analysisAI

CVE-2026-31281 is an HTML injection vulnerability (CWE-79) affecting Totara LMS versions 19.1.5 and earlier, specifically in the in-app messaging client of Totara Learning. Published on 2026-04-13, it has a CVSS v3.1 base score of 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), indicating high severity with network accessibility, low attack complexity, low privileges required, and user interaction needed.

An authenticated attacker with low privileges can inject malicious HTML code into a message and send it to all users in the application. When victims view the message, the injected code executes in their browsers, potentially leading to session hijacking and arbitrary command execution on the victim's browser.

The supplier notes that the in-app messaging client only permits a specific allowed list of HTML tags for text enhancement, such as italic, bold, underline, and strong, while sanitizing input via DOMPurify to block dangerous tags like script, style, iframe, object, embed, form, input, button, svg, and math, as well as disallowed attributes including onerror and onaction. References include https://github.com/saykino/CVE-2026-31281 and https://www.totara.com/.