MEDIUM5.5npm
GHSA-4hwx-xcc5-2hfc· CVE-2025-31475tarteaucitron.js allows prototype pollution via custom text injection
Modified: 4/7/2025
package
npm/tarteaucitronjs
pkg:npm/tarteaucitronjs
MEDIUM5.5npm
GHSA-7524-3396-fqv3· CVE-2025-31138tarteaucitron.js allows UI manipulation via unrestricted CSS injection
Modified: 4/7/2025
MEDIUM6.1npm
GHSA-8wp9-x25p-8794· CVE-2025-1467tarteaucitron Cross-site Scripting (XSS)
Modified: 2/24/2025
MEDIUM4.6npm
GHSA-f44m-65h3-99vc· CVE-2023-3620tarteaucitron.js vulnerable to Cross-site Scripting
Modified: 11/8/2023
MEDIUM4.3npm
GHSA-jxj7-g6gm-49j7· CVE-2026-49977tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies
Modified: 7/10/2026
MEDIUM4.8npm
GHSA-p5g4-v748-6fh8· CVE-2025-31476, DRUPAL-CONTRIB-2025-027tarteaucitron.js allows url scheme injection via unfiltered inputs
Modified: 12/10/2025
MEDIUM4.2npm
GHSA-q43x-79jr-cq98· CVE-2025-48939tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript
Modified: 7/3/2025
MEDIUM4.4npm
GHSA-q5f6-qxm2-mcqm· CVE-2026-22809tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability
Modified: 2/3/2026