Is CVE-2025-31475 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-31475 being exploited in the wild.

How severe is CVE-2025-31475?

Low severity, with a CVSS score of 3.1, published 7 April 2025.

Which products and versions are affected?

tarteaucitronjs (npm) SEMVER:introduced=0,fixed=1.20.1.

Is there a fix for CVE-2025-31475?

Yes. tarteaucitronjs (npm): upgrade to 1.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-31475 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-31475?

Check whether you run tarteaucitronjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-31475: tarteaucitron.js prototype pollution in custom text injection

CVE-2025-31475 · Severity: low · CVSS 3.1 · Published 2025-04-07

tarteaucitron.js is a JavaScript library that manages cookie consent banners for GDPR compliance on websites. A prototype pollution vulnerability allows attackers with administrative access to a website's CMS or source code to corrupt the underlying JavaScript object structure, potentially causing the site to malfunction or enabling further attacks. The vulnerability requires high-level access and does not directly expose user data but can compromise application integrity and stability.

Technologies: tarteaucitronjs (npm). Vendors: npm.

Quick answers

Is CVE-2025-31475 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-31475 being exploited in the wild.
How severe is CVE-2025-31475?: Low severity, with a CVSS score of 3.1, published 7 April 2025.
Which products and versions are affected?: tarteaucitronjs (npm) SEMVER:introduced=0,fixed=1.20.1.
Is there a fix for CVE-2025-31475?: Yes. tarteaucitronjs (npm): upgrade to 1.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-31475 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-31475?: Check whether you run tarteaucitronjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tarteaucitronjs (npm): upgrade to 1.20.1 or later
```
npm install tarteaucitronjs@1.20.1
```

Technical details

The vulnerability is a prototype pollution (CWE-1321) flaw in tarteaucitron.js's addOrUpdate function, which handles custom text injection without proper input validation. An attacker with direct access to site source code or CMS plugin control can craft malicious input that modifies JavaScript object prototypes, affecting core language behavior. The attack vector is network-based but requires high privileges (PR:H), no user interaction, and results in low confidentiality and integrity impact (CVSS 5.5). The attack does not require any specific preconditions beyond administrative-level access. The vulnerability was patched in version 1.20.1 through input sanitization to prevent prototype attribute modification.

Affected products

AmauriC tarteaucitron.js < 1.20.1

Identifiers

CVE-2025-31475
GHSA-4hwx-xcc5-2hfc

Timeline

2025-04-07: disclosed: Vulnerability published as GHSA-4hwx-xcc5-2hfc and CVE-2025-31475
2025-04-07: patched: Fixed in version 1.20.1 via commit 74c354c to prevent prototype pollution

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.