CVE-2026-31382

MEDIUM

Gainsight Assist reflected XSS/HTML injection

Title source: cna

The error_description parameter is vulnerable to Reflected XSS. An attacker can bypass the domain's WAF using a Safari-specific onpagereveal payload.

Core 2

Core References

Third Party Advisory third-party-advisory

Vendor Advisory vendor-advisory

CVSS v3 6.1

EPSS 0.0024

EPSS Percentile 15.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

CWE

CWE-79

Status published

Products (2)

gainsight/assist

Gainsight/Gainsight Assist

Published Mar 20, 2026

Tracked Since Mar 20, 2026