CVE-2026-111713
MediumCVSS 5.4Summary
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.
Risk Assessment
An attacker can execute arbitrary JavaScript in the site's context, potentially leading to session theft, content modification, or other attacks. This requires the ability to place markup, e.g., by a CMS author.
Recommendation
Update tarteaucitron.js to version 1.37.0 or later. Until then, consider restricting markup placement capabilities for untrusted users.
Other vulnerabilities in tarteaucitron.js
See all- CVE-2026-111714Low
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
- CVE-2026-49977Medium
Vulnerability in tarteaucitron.js before version 1.33.0. The tarteaucitron.cookie.purge() function is called on any element with the purgeBtn class without checking if it is a legitimate tarteaucitron button. An attacker can delete a non-HttpOnly cookie with a known name via user click.
Original NVD description (English source)
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS