CVE-2026-31281 is an HTML Injection vulnerability affecting Totara LMS v19.1.5 and earlier. The issue exists in the in-app messaging client, where an attacker can inject malicious HTML code into messages sent to users. The vendor notes that the client only allows a limited set of safe HTML tags (e.g., italic, bold, underline) and sanitizes any disallowed tags or attributes (such as <script>, <iframe>, event handlers) using DOMPurify. Despite these protections, the vulnerability is rated with a CVSS score of 8.0, indicating high severity due to potential session hijacking and command execution risks. No patch or official remediation level has been disclosed.

Successful exploitation could allow an attacker with limited privileges to execute arbitrary HTML code in the context of other users' browsers, potentially leading to session hijacking and execution of commands. This could compromise user sessions and data confidentiality. However, the vendor's use of a strict HTML whitelist and DOMPurify sanitization reduces the attack surface by preventing embedding of dangerous tags and attributes.

No official patch or remediation guidance is currently available. The vendor states that the in-app messaging client sanitizes disallowed HTML tags and attributes using DOMPurify and restricts allowed tags to a safe whitelist. Users should monitor vendor advisories for updates or patches. Until a fix is released, consider restricting messaging functionality or applying additional input validation if possible.