Executive brief
tarteaucitron.js is a JavaScript library that manages cookie consent and user preferences on websites. A vulnerability allows users with high privileges (CMS access, source code access) to inject malicious URLs containing JavaScript code (like javascript:alert()) that execute when other users click the links, potentially stealing data or modifying the site's behavior.
Technical details
This is a cross-site scripting (CWE-79) vulnerability caused by insufficient URL validation in tarteaucitron.js. An attacker with high-level privileges can inject URLs with unsafe schemes (e.g., javascript:, data:) into the application; these URLs are not properly validated before being rendered in the web page. The attack requires both high privileges to insert the malicious URL and user interaction (clicking the link). When a victim clicks the injected link, arbitrary JavaScript executes in their browser context with access to the page. The vulnerability was fixed in version 1.20.1 by implementing strict URL validation that only allows http:// and https:// schemes.
Affected products
- AmauriC tarteaucitron.js before 1.20.1
Timeline
- 2025-04-07: disclosed
- 2025-04-07: patched: Version 1.20.1 released with fix