Threat Intelligence Database

tarteaucitron.js versions before 1.37.0 contain a regular expression denial of service (ReDoS) vulnerability. This flaw allows attackers to cause page freezes by supplying specially crafted unescaped cookie names to the cookie.purge function. The vulnerability can be triggered by planting a cookie from a sibling subdomain or injecting a purgeBtn element with a malicious data-cookie pattern that causes catastrophic backtracking when the purge button is clicked. The CVSS 4.0 score rates this issue as low severity.

tarteaucitron.js versions from 1.20.1 up to but not including 1.37.0 contain a cross-site scripting (XSS) vulnerability. The issue arises because the function getElemAttr processes 'data-' prefixed attributes differently than the https-only guard, allowing an attacker with the ability to insert markup (e.g., CMS authors) to inject a javascript: URL via a data-url attribute. This can lead to script execution in the context of the affected site through an iframe src attribute. The vulnerability has a medium severity with a CVSS 4.0 score of 5.1.

tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element, it could clobber the document.currentScript property. This causes the script to resolve incorrectly to an element instead of the <script> tag, leading to unexpected behavior or failure to load the script path correctly. This issue arises because in some browser environments, named DOM elements become properties on the global document object. An attacker with control over the HTML could exploit this to change the CDN domain of tarteaucitron. This issue has been patched in version 1.22.0.

MediumVulnerabilityFranceGermanyUnited Kingdom+5#cve#cve-2025-48939#cwe-138

tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert(). Before the fix, URL validation was insufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link. An attacker with high privileges could insert a link exploiting an insecure URL scheme, leading to execution of arbitrary JavaScript code, theft of sensitive data through phishing attacks, or modification of the user interface behavior. This vulnerability is fixed in 1.20.1.

MediumVulnerabilityFranceGermanyUnited Kingdom+5#cve#cve-2025-31476#cwe-79