Medium · 6.1 CVE-2026-31382 EUVD-2026-13686

Gainsight Assist reflected XSS/HTML injection

Published Mar 20, 2026 · Updated Mar 23, 2026 · Assigned by rapid7

Vendor: Gainsight Product: Gainsight Assist

Description

The error_description parameter is vulnerable to Reflected XSS. An attacker can bypass the domain's WAF using a Safari-specific onpagereveal payload.

Affected products

Vendor	Product	Affected	Fixed
Gainsight	Gainsight Assist	—	—

References