# CVE-2025-31475: tarteaucitron.js prototype pollution in custom text injection

Source: https://junglewise.ai/threats/cve-2025-31475-tarteaucitron-js-prototype-pollution-in-custom-text-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-04-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-31475 · Severity: low · CVSS 3.1 · Published 2025-04-07

tarteaucitron.js is a JavaScript library that manages cookie consent banners for GDPR compliance on websites. A prototype pollution vulnerability allows attackers with administrative access to a website's CMS or source code to corrupt the underlying JavaScript object structure, potentially causing the site to malfunction or enabling further attacks. The vulnerability requires high-level access and does not directly expose user data but can compromise application integrity and stability.

Technologies: [tarteaucitronjs (npm)](https://junglewise.ai/threats/technologies/tarteaucitronjs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-31475 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-31475 being exploited in the wild.

**How severe is CVE-2025-31475?** Low severity, with a CVSS score of 3.1, published 7 April 2025.

**Which products and versions are affected?** tarteaucitronjs (npm) SEMVER:introduced=0,fixed=1.20.1.

**Is there a fix for CVE-2025-31475?** Yes. tarteaucitronjs (npm): upgrade to 1.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-31475 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-31475?** Check whether you run tarteaucitronjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- tarteaucitronjs (npm): upgrade to 1.20.1 or later

  ```sh
  npm install tarteaucitronjs@1.20.1
  ```


## Technical details

The vulnerability is a prototype pollution (CWE-1321) flaw in tarteaucitron.js's addOrUpdate function, which handles custom text injection without proper input validation. An attacker with direct access to site source code or CMS plugin control can craft malicious input that modifies JavaScript object prototypes, affecting core language behavior. The attack vector is network-based but requires high privileges (PR:H), no user interaction, and results in low confidentiality and integrity impact (CVSS 5.5). The attack does not require any specific preconditions beyond administrative-level access. The vulnerability was patched in version 1.20.1 through input sanitization to prevent prototype attribute modification.

## Affected products

- AmauriC tarteaucitron.js < 1.20.1

## Identifiers

- CVE-2025-31475
- GHSA-4hwx-xcc5-2hfc

## Timeline

- 2025-04-07: disclosed: Vulnerability published as GHSA-4hwx-xcc5-2hfc and CVE-2025-31475
- 2025-04-07: patched: Fixed in version 1.20.1 via commit 74c354c to prevent prototype pollution

## References

- [https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-4hwx-xcc5-2hfc](https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-4hwx-xcc5-2hfc)
- [https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b](https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b)
- [https://github.com/AmauriC/tarteaucitron.js](https://github.com/AmauriC/tarteaucitron.js)

## Related threats

- [AmauriC tarteaucitron.js unauthorized cookie deletion via data-cookie attribute](https://junglewise.ai/threats/cve-2026-49977-amauric-tarteaucitron-js-unauthorized-cookie-deletion-via-data)
- [tarteaucitron.js Regular Expression Denial of Service](https://junglewise.ai/threats/cve-2026-22809-tarteaucitron-js-regular-expression-denial-of-service)
- [tarteaucitron.js DOM Clobbering via document.currentScript](https://junglewise.ai/threats/cve-2025-48939-tarteaucitron-js-dom-clobbering-via-document-currentscript)
- [tarteaucitron.js CSS injection enabling UI manipulation](https://junglewise.ai/threats/cve-2025-31138-tarteaucitron-js-css-injection-enabling-ui-manipulation)
- [tarteaucitron.js URL scheme injection via unfiltered inputs](https://junglewise.ai/threats/cve-2025-31476-tarteaucitron-js-url-scheme-injection-via-unfiltered-inputs)