CVE-2026-111713: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in AmauriC tarteaucitron.js

CVE-2026-111713 is a cross-site scripting vulnerability in tarteaucitron.js before version 1.37.0. The root cause is inconsistent handling of 'data-' prefixed attributes by the getElemAttr function compared to the https-only guard, which only validates the unprefixed attribute. This discrepancy allows attackers who can insert markup (such as CMS authors) to add a data-url attribute containing a javascript: URL alongside a benign URL. This results in script execution within the site's origin via an iframe src, potentially compromising the security context of the web page.

Successful exploitation allows an attacker with the ability to insert markup to execute arbitrary JavaScript in the context of the vulnerable website. This can lead to unauthorized actions or data exposure within the site's origin. The impact is limited by the requirement that the attacker must have some level of content insertion capability (e.g., CMS author privileges). There are no known exploits in the wild at this time.

A fix is available in tarteaucitron.js version 1.37.0 and later. Users should upgrade to version 1.37.0 or newer to remediate this vulnerability. Until then, restrict permissions to insert markup in the CMS or other content management interfaces to trusted users only. Patch status is confirmed by the version range affected and the fixed version stated.