# tarteaucitronjs (npm) vulnerabilities

8 known vulnerabilities (8 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://www.npmjs.com/package/tarteaucitronjs

## Advisories (8)

### [CVE-2026-49977](https://cve.now/CVE-2026-49977): tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies

- Severity: Medium 4.3
- Published: Jul 17, 2026
- Affected: fixed in 1.33.0.

### [CVE-2026-22809](https://cve.now/CVE-2026-22809): tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability

- Severity: Medium 4.4
- Published: Jan 13, 2026
- Affected: fixed in 1.29.0.

### [CVE-2025-48939](https://cve.now/CVE-2025-48939): tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

- Severity: Medium 4.2
- Published: Jul 3, 2025
- Affected: fixed in 1.22.0.

### [CVE-2025-31476](https://cve.now/CVE-2025-31476): tarteaucitron.js allows url scheme injection via unfiltered inputs

- Severity: Medium 4.8
- Published: Apr 7, 2025
- Affected: fixed in 1.20.1.

### [CVE-2025-31475](https://cve.now/CVE-2025-31475): tarteaucitron.js allows prototype pollution via custom text injection

- Severity: Medium 5.5
- Published: Apr 7, 2025
- Affected: fixed in 1.20.1.

### [CVE-2025-31138](https://cve.now/CVE-2025-31138): tarteaucitron.js allows UI manipulation via unrestricted CSS injection

- Severity: Medium 5.5
- Published: Apr 7, 2025
- Affected: fixed in 1.20.1.

### [CVE-2025-1467](https://cve.now/CVE-2025-1467): Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and…

- Severity: Medium 5.1
- Published: Feb 23, 2025
- Affected: fixed in 1.17.0.

### [CVE-2023-3620](https://cve.now/CVE-2023-3620): Cross-site Scripting (XSS) - Stored in amauric/tarteaucitron.js

- Severity: Medium 4.6
- Published: Jul 11, 2023
- Affected: fixed in 1.13.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/tarteaucitronjs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.