tarteaucitron.js vulnerabilities

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.

Vulnerability in tarteaucitron.js before version 1.33.0. The tarteaucitron.cookie.purge() function is called on any element with the purgeBtn class without checking if it is a legitimate tarteaucitron button. An attacker can delete a non-HttpOnly cookie with a known name via user click.