Executive brief
tarteaucitron.js is a JavaScript library that manages cookie consent banners for GDPR compliance on websites. A prototype pollution vulnerability allows attackers with administrative access to a website's CMS or source code to corrupt the underlying JavaScript object structure, potentially causing the site to malfunction or enabling further attacks. The vulnerability requires high-level access and does not directly expose user data but can compromise application integrity and stability.
Technical details
The vulnerability is a prototype pollution (CWE-1321) flaw in tarteaucitron.js's addOrUpdate function, which handles custom text injection without proper input validation. An attacker with direct access to site source code or CMS plugin control can craft malicious input that modifies JavaScript object prototypes, affecting core language behavior. The attack vector is network-based but requires high privileges (PR:H), no user interaction, and results in low confidentiality and integrity impact (CVSS 5.5). The attack does not require any specific preconditions beyond administrative-level access. The vulnerability was patched in version 1.20.1 through input sanitization to prevent prototype attribute modification.
Affected products
- AmauriC tarteaucitron.js < 1.20.1
Timeline
- 2025-04-07: disclosed: Vulnerability published as GHSA-4hwx-xcc5-2hfc and CVE-2025-31475
- 2025-04-07: patched: Fixed in version 1.20.1 via commit 74c354c to prevent prototype pollution