Skip to main content
cve.nowby Sazabi
← npm
npmPackage

tarteaucitronjs

8 known vulnerabilities (8 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 8 medium
Registry
npm

Advisories 8

  • CVE-2026-49977Medium 4.3

    tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies

    Affected: fixed in 1.33.0.

  • CVE-2026-22809Medium 4.4

    tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability

    Affected: fixed in 1.29.0.

  • CVE-2025-48939Medium 4.2

    tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

    Affected: fixed in 1.22.0.

  • CVE-2025-31476Medium 4.8

    tarteaucitron.js allows url scheme injection via unfiltered inputs

    Affected: fixed in 1.20.1.

  • CVE-2025-31475Medium 5.5

    tarteaucitron.js allows prototype pollution via custom text injection

    Affected: fixed in 1.20.1.

  • CVE-2025-31138Medium 5.5

    tarteaucitron.js allows UI manipulation via unrestricted CSS injection

    Affected: fixed in 1.20.1.

  • CVE-2025-1467Medium 5.1

    Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and…

    Affected: fixed in 1.17.0.

  • CVE-2023-3620Medium 4.6

    Cross-site Scripting (XSS) - Stored in amauric/tarteaucitron.js

    Affected: fixed in 1.13.1.