{"id":"CVE-2026-49977","aliases":["DRUPAL-CONTRIB-2026-040","EUVD-2026-45318","GHSA-jxj7-g6gm-49j7"],"status":"published","title":"tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies","description":"tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by tarteaucitron. If an attacker can write HTML with data attributes, an element with data-cookie can silently delete a non-HttpOnly cookie with a known name when clicked by a user. This issue is fixed in version 1.33.0.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00354,"percentile":0.29405,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285"],"published":"2026-06-03T16:11:51Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"npm","package":"tarteaucitronjs","fixed_in":["1.33.0"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/tacjs","fixed_in":["6.8.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"tarteaucitronjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.0"}]}]},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/tacjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.0"}]}]},{"source":"osv","ecosystem":"npm","package":"tarteaucitronjs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.33.0"}]}]}],"products":[{"vendor":"amauric","product":"tarteaucitron.js"}],"references":[{"url":"https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-jxj7-g6gm-49j7","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/AmauriC/tarteaucitron.js/commit/24b5464400ae2ff1ad96a092c629b9d632b9cc93","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/AmauriC/tarteaucitron.js/releases/tag/v1.33.0","tags":["x_refsource_MISC","web"]},{"url":"https://www.drupal.org/sa-contrib-2026-040","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jxj7-g6gm-49j7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49977.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49977","tags":["advisory"]},{"url":"https://github.com/AmauriC/tarteaucitron.js","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-49977","title":"tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies","description":"tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by tarteaucitron. If an attacker can write HTML with data attributes, an element with data-cookie can silently delete a non-HttpOnly cookie with a known name when clicked by a user. This issue is fixed in version 1.33.0.","status":"published","published":"2026-07-17T20:21:21.476Z","modified":"2026-07-20T19:11:28.659Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T13:34:59.78118Z"}],"euvd":[{"id":"EUVD-2026-45318","description":"tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by tarteaucitron. If an attacker can write HTML with data attributes, an element with data-cookie can silently delete a non-HttpOnly cookie with a known name when clicked by a user. This issue is fixed in version 1.33.0.","status":"published","published":"2026-07-17T20:21:21Z","modified":"2026-07-20T19:11:28Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:47.959089Z"}],"ghsa":[{"id":"GHSA-jxj7-g6gm-49j7","title":"tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies","description":"### Summary\n\ntarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element that silently deletes a cookie when clicked and trick a user to delete this cookie.\n\n### Details\n\n`tarteaucitron.cookie.purge()` is called on any element with the `purgeBtn` class. It does not check if the element is a legitimate tarteaucitron button or if the cookie corresponds to a service handled by tarteaucitron.\n\n### PoC\n\n```html\n\u003ca class=\"purgeBtn\" data-cookie=\"foo\"\u003eClick me!\u003c/a\u003e\n```\n\nIf someone has a cookie with this name and clicks on the link, the cookie is silently deleted.\n\n### Impact\n\nThe impact is limited because this only works on cookies without HttpOnly=true and the attacker has to know the name of the cookie.","status":"published","published":"2026-07-10T16:05:00Z","modified":"2026-07-10T16:05:02Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:40:42.703776Z"}],"nvd":[{"id":"CVE-2026-49977","description":"tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by tarteaucitron. If an attacker can write HTML with data attributes, an element with data-cookie can silently delete a non-HttpOnly cookie with a known name when clicked by a user. This issue is fixed in version 1.33.0.","status":"published","published":"2026-07-17T21:17:06.93Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:12:30.631352Z"}],"osv":[{"id":"CVE-2026-49977","title":"tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies","description":"tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by tarteaucitron. If an attacker can write HTML with data attributes, an element with data-cookie can silently delete a non-HttpOnly cookie with a known name when clicked by a user. This issue is fixed in version 1.33.0.","status":"published","published":"2026-07-17T20:21:21.476Z","modified":"2026-10-28T02:31:04.552721331Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"GHSA-jxj7-g6gm-49j7","title":"tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies","description":"### Summary\n\ntarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element that silently deletes a cookie when clicked and trick a user to delete this cookie.\n\n### Details\n\n`tarteaucitron.cookie.purge()` is called on any element with the `purgeBtn` class. It does not check if the element is a legitimate tarteaucitron button or if the cookie corresponds to a service handled by tarteaucitron.\n\n### PoC\n\n```html\n\u003ca class=\"purgeBtn\" data-cookie=\"foo\"\u003eClick me!\u003c/a\u003e\n```\n\nIf someone has a cookie with this name and clicks on the link, the cookie is silently deleted.\n\n### Impact\n\nThe impact is limited because this only works on cookies without HttpOnly=true and the attacker has to know the name of the cookie.","status":"published","published":"2026-07-10T16:05:00Z","modified":"2026-07-10T16:26:41.089772Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"DRUPAL-CONTRIB-2026-040","description":"This module enables sites to comply with the European cookie law using tarteaucitron.js.\n\nThe module doesn't sufficiently filter user-supplied markup inside of content leading to an attacker being able to delete arbitrary cookies.\n\nThis vulnerability is mitigated by the fact that an attacker needs to be able to insert specific data attributes in the page.\n\nFor additional information, see the [Github Security Advisory GHSA-jxj7-g6gm-49j7](https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-jxj7-g6gm-49j7) for the tarteaucitron.js library.","status":"published","published":"2026-06-03T16:11:51Z","modified":"2026-09-10T03:46:11.196499741Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}