Threats affecting pkg:github/amauric/tarteaucitron.js

tarteaucitron.js versions before 1.37.0 have a regular expression denial of service (ReDoS) vulnerability. This flaw arises from inefficient regular expression handling in the cookie.purge function, which can be exploited by attackers supplying unescaped cookie names or injecting a specially crafted purgeBtn element. Triggering the vulnerability causes catastrophic backtracking in the regex engine, freezing the page when the purge button is clicked. The CVSS score is low (2.3), reflecting the requirement for user interaction and high attack complexity.

tarteaucitron.js versions from 1.20.1 up to but not including 1.37.0 contain a cross-site scripting (XSS) vulnerability. This occurs because the function getElemAttr resolves 'data-' prefixed attributes, but the validation for https-only URLs only checks the unprefixed attribute. An attacker with the ability to insert markup, such as a CMS author, can exploit this by adding a data-url attribute with a javascript: URL alongside a benign URL, leading to script execution in the site's origin via an iframe src.

tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element, it could clobber the document.currentScript property. This causes the script to resolve incorrectly to an element instead of the <script> tag, leading to unexpected behavior or failure to load the script path correctly. This issue arises because in some browser environments, named DOM elements become properties on the global document object. An attacker with control over the HTML could exploit this to change the CDN domain of tarteaucitron. This issue has been patched in version 1.22.0.

tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert(). Before the fix, URL validation was insufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link. An attacker with high privileges could insert a link exploiting an insecure URL scheme, leading to execution of arbitrary JavaScript code, theft of sensitive data through phishing attacks, or modification of the user interface behavior. This vulnerability is fixed in 1.20.1.