Executive brief
tarteaucitron is a popular JavaScript consent management library used to display cookie notices and manage user privacy choices on websites. The library contains a stored or reflected cross-site scripting (XSS) vulnerability in width and height calculation functions that could allow attackers to inject malicious scripts and steal sensitive data, deface content, or perform actions on behalf of users visiting affected sites.
Technical details
The vulnerability is a CWE-79 Cross-site Scripting flaw in the getElemWidth() and getElemHeight() methods of tarteaucitron versions before 1.17.0. These functions improperly handle user input or DOM attributes without adequate sanitization or encoding, allowing attackers to inject executable JavaScript code. The attack requires user interaction (visiting a malicious page) but has a network attack vector. An attacker can exploit this by crafting a page with malicious width or height attribute values that get processed by the vulnerable functions, resulting in arbitrary script execution in the context of the user's browser. The vulnerability was fixed in version 1.17.0 by using the safer getElemAttr utility method.
Affected products
- Amuri Cardon tarteaucitronjs before 1.17.0
Timeline
- 2025-02-23: disclosed
- 2025-02-23: patched: Fix released in version 1.17.0