Executive brief
Orejime is a consent management library used to handle user preferences for cookies and tracking. The library can be tricked into executing malicious JavaScript code embedded in HTML attributes when a user consents to a tracked purpose. This risk is mitigated in most real-world deployments since Orejime typically only processes hardcoded HTML elements, but could become critical if an attacker can inject HTML into a page.
Technical details
Orejime contains a cross-site scripting (XSS) vulnerability in its attribute handling logic. The vulnerability occurs when Orejime strips the "data-" prefix from HTML attributes (e.g., converting data-href to href) following user consent. An attacker can embed javascript: URIs within data attributes, which become executable once the prefix is removed and the attribute is unprefixed. The attack requires either HTML injection capability on the target page or control over hardcoded elements, and the user must grant consent to the associated tracking purpose. The vulnerability has been patched in version 2.3.2 via sanitization of executable attribute values.
Affected products
- boscop-fr Orejime <2.3.2
Timeline
- 2025-12-19: disclosed
- 2025-12-19: patched: version 2.3.2