Skip to content
OpenAdvisories

Package · npm

tarteaucitronjs

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Feed

  • Medium 4.3
    CVE-2026-49977

    tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies

    tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corr…

    amauric tarteaucitron.js tarteaucitronjs npm
  • Medium 4.4
    CVE-2026-22809

    tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability

    tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the issuu_id parameter. This vulnerability is fixed in 1.29.0.

    amauric tarteaucitron.js tarteaucitronjs npm
  • Medium 4.2
    CVE-2025-48939

    tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

    tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker…

    amauric tarteaucitron.js tarteaucitronjs npm
  • Medium 4.8
    CVE-2025-31476

    tarteaucitron.js allows url scheme injection via unfiltered inputs

    tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as java…

    amauric tarteaucitron.js tarteaucitronjs drupal/tacjs npm Packagist
  • Medium 5.5
    CVE-2025-31475

    tarteaucitron.js allows prototype pollution via custom text injection

    tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where the addOrUpdate function, used for applying custom texts, did not properly validate input. This allowed an attacker with di…

    amauric tarteaucitron.js tarteaucitronjs npm
  • Medium 5.5
    CVE-2025-31138

    tarteaucitron.js allows UI manipulation via unrestricted CSS injection

    tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allowed an attacker with…

    amauric tarteaucitron.js tarteaucitronjs npm
  • Medium 6.1
    CVE-2025-1467

    tarteaucitron Cross-site Scripting (XSS)

    Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and getElemHeight(). This is related to [SNYK-JS-TARTEAUCITRONJS-8366541](https://security.snyk.io/vuln/SNYK-JS-TARTEAUCITRONJS-8366541)

    tarteaucitronjs npm
  • Medium 4.6
    CVE-2023-3620

    Cross-site Scripting (XSS) - Stored in amauric/tarteaucitron.js

    Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.

    amauric amauric/tarteaucitron.js tarteaucitronjs npm