p PatchFirst

CVE-2025-31476

CVE-2025-31476 · tarteaucitron.js allows url scheme injection via unfiltered inputs

This page contains facts from public vulnerability sources. Check the original advisory before updating.

tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert(). Before the fix, URL validation was insufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link. An attacker with high privileges could insert a link exploiting an insecure URL scheme, leading to execution of arbitrary JavaScript code, theft of sensitive data through phishing attacks, or modification of the user interface behavior. This vulnerability is fixed in 1.20.1.

CVSS 4.8 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: php · node

Affected products and versions

  • tarteaucitron.js

    Versions
    • < 1.20.1: Affected

    No fix published

  • tarteaucitronjs npm

    Affected ranges
    • SEMVER: < 1.20.1

    Update to 1.20.1

  • drupal/tacjs Packagist:https://packages.drupal.org/8

    Affected ranges
    • ECOSYSTEM: < 6.7.0

    Update to 6.7.0

Original sources

Check your server →