Executive brief
This module enables sites to comply with the European cookie law using tarteaucitron.js.
The module doesn't sufficiently filter user-supplied markup inside of content leading to a persistent Cross Site Scripting (XSS) vulnerability. More details are available in [CVE-2023-3620](https://nvd.nist.gov/vuln/detail/CVE-2023-3620).
This vulnerability is mitigated by the fact that an attacker needs to be able to write content in the page, a feature commonly available on Drupal sites.
Affected products
- packagist:https://packages.drupal.org/8 drupal/tacjs