Is CVE-2026-49977 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49977 being exploited in the wild.

How severe is CVE-2026-49977?

Medium severity, with a CVSS score of 4.3, published 17 July 2026.

Which products and versions are affected?

AmauriC Tarteaucitron.Js < 1.33.0; Drupal TacJS < 8.x-6.8; tarteaucitronjs (npm) < 1.33.0, SEMVER:introduced=0,fixed=1.33.0.

Is there a fix for CVE-2026-49977?

Yes. tarteaucitronjs (npm): upgrade to 1.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49977 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49977?

Check whether you run AmauriC Tarteaucitron.Js, Drupal TacJS or tarteaucitronjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49977: AmauriC tarteaucitron.js unauthorized cookie deletion via data-cookie attribute

Q: Is there a fix for CVE-2026-49977?

Yes. tarteaucitronjs (npm): upgrade to 1.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49977 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-49977?

Check whether you run AmauriC Tarteaucitron.Js, Drupal TacJS or tarteaucitronjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49977 · Severity: medium · CVSS 4.3 · Published 2026-07-17

tarteaucitron.js is a popular tool used by websites to manage cookie consent and comply with privacy laws. A security flaw allows an attacker who can post content on a site (such as in a comment or profile) to create a hidden trigger that deletes a visitor's cookies when they click a specific link. This could be used to disrupt user sessions or clear preferences, though it cannot be used to steal sensitive data protected by standard browser security settings.

Technologies: AmauriC Tarteaucitron.Js, tarteaucitronjs (npm). Vendors: AmauriC, Drupal, npm.

Quick answers

Is CVE-2026-49977 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49977 being exploited in the wild.
How severe is CVE-2026-49977?: Medium severity, with a CVSS score of 4.3, published 17 July 2026.
Which products and versions are affected?: AmauriC Tarteaucitron.Js < 1.33.0; Drupal TacJS < 8.x-6.8; tarteaucitronjs (npm) < 1.33.0, SEMVER:introduced=0,fixed=1.33.0.
Is there a fix for CVE-2026-49977?: Yes. tarteaucitronjs (npm): upgrade to 1.33.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49977 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49977?: Check whether you run AmauriC Tarteaucitron.Js, Drupal TacJS or tarteaucitronjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

tarteaucitronjs (npm): upgrade to 1.33.0 or later
```
npm install tarteaucitronjs@1.33.0
```

Technical details

An improper authorization vulnerability (CWE-285) exists in tarteaucitron.js due to insufficient validation in the cookie purging mechanism. The `tarteaucitron.cookie.purge()` function is triggered by any HTML element assigned the `purgeBtn` class without verifying if the element is a legitimate part of the library's UI. If an attacker can inject HTML with data attributes (e.g., via a CMS or comment section), they can use the `data-cookie` attribute to specify a cookie name for deletion. When a user clicks the malicious element, the specified non-HttpOnly cookie is deleted. This issue is fixed in tarteaucitron.js version 1.33.0 and Drupal TacJS version 8.x-6.8.

Affected products

AmauriC tarteaucitron.js < 1.33.0
Drupal TacJS < 8.x-6.8

Identifiers

CVE-2026-49977
GHSA-jxj7-g6gm-49j7

Timeline

2026-05-27: patched: tarteaucitron.js version 1.33.0 released
2026-06-03: advisory: GitHub Security Advisory and Drupal SA-CONTRIB-2026-040 published
2026-07-17: disclosed: CVE-2026-49977 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.