CVE-2025-31476
📋 TL;DR
A cross-site scripting (XSS) vulnerability in tarteaucitron.js allows privileged users to inject malicious JavaScript links into cookie banners. When clicked by other users, these links can execute arbitrary JavaScript in the victim's browser context. This affects websites using vulnerable versions of tarteaucitron.js for cookie consent management.
💻 Affected Systems
- tarteaucitron.js
📦 What is this software?
Tacjs by Tacjs Project
⚠️ Risk & Real-World Impact
Worst Case
Privileged attacker steals session cookies, credentials, or sensitive data via phishing, performs account takeover, or modifies UI to trick users into harmful actions.
Likely Case
Privileged user (e.g., compromised admin) inserts malicious link that executes JavaScript when clicked, potentially stealing limited session data or redirecting users.
If Mitigated
With proper input validation and least privilege controls, impact is limited to low-privilege users clicking crafted links with minimal data exposure.
🎯 Exploit Status
Exploitation requires privileged access to inject malicious URL. No public exploit code identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.20.1
Vendor Advisory: https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-p5g4-v748-6fh8
Restart Required: No
Instructions:
1. Update tarteaucitron.js to version 1.20.1 or later. 2. Replace the tarteaucitron.js file in your project with the patched version. 3. Clear any caches (browser, CDN, server). 4. Test cookie banner functionality.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to reject URLs with javascript: or other dangerous schemes in tarteaucitron.js configuration inputs.
Implement regex filter: /^(?!javascript:|data:|vbscript:).*/i on URL inputs
🧯 If You Can't Patch
- Restrict administrative access to only trusted users with strong authentication.
- Implement Content Security Policy (CSP) with script-src directives to limit JavaScript execution.
🔍 How to Verify
Check if Vulnerable:
Check if tarteaucitron.js version is below 1.20.1 in your website's source code or dependencies.Check Version:
grep -r 'tarteaucitron' package.json or check script tag src attribute in HTMLVerify Fix Applied:
Confirm tarteaucitron.js version is 1.20.1 or higher and test that javascript: URLs are blocked in cookie banner links.📡 Detection & Monitoring
Log Indicators:
- Unusual admin activity inserting URLs with javascript: schemes
- Error logs from URL validation failures
Network Indicators:
- HTTP requests containing javascript: URLs in parameters
SIEM Query:
search 'javascript:' in web application logs or admin panel access logs