In tarteaucitronjs versions before 1.33.0, the purge function responsible for deleting cookies does not validate whether the triggering element is a legitimate control or if the cookie targeted belongs to a managed service. An attacker who can inject HTML with data-cookie attributes can craft elements that, when clicked by a user, delete arbitrary cookies. This vulnerability requires user interaction and knowledge of the cookie name. Cookies flagged as HttpOnly are not affected. There is no indication of known exploits in the wild and no official patch information is provided.

An attacker with the ability to inject HTML and knowledge of cookie names can cause users to delete arbitrary cookies that are not protected by the HttpOnly flag. This could disrupt user sessions or application functionality relying on such cookies. The vulnerability does not allow direct cookie theft or modification, and requires user interaction, limiting its severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or sanitize user-supplied HTML to prevent injection of elements with data-cookie attributes. Consider setting sensitive cookies with the HttpOnly flag to prevent deletion via this method.