Executive brief
Totara Learning, a platform used by organizations to manage employee training and compliance, contains a vulnerability in its internal messaging system. An authenticated user can send messages containing malicious code to other users or the entire organization. If a victim views the message, an attacker could potentially take over their session or execute unauthorized actions within their browser.
Technical details
A vulnerability in the 'Messages box' component of Totara Learning (formerly Totara LMS) allows for HTML injection. An authenticated attacker can craft a message containing malicious HTML/JavaScript and distribute it to other users. While the vendor disputes the severity by stating they use DOMPurify and an allow-list of tags (italic, bold, etc.) to prevent dangerous elements like <script> or <object>, the reporter claims the vulnerability can still lead to session hijacking and remote command execution in the victim's browser context. The issue is addressed in versions released after 19.1.5.
Affected products
- Totara Totara Learning (formerly Totara LMS) <= 19.1.5
Timeline
- 2026-04-13: disclosed
- 2026-04-13: advisory
- 2026-04-24: other: Vendor disputed the vulnerability details and provided clarification on sanitization measures.