drupal/tacjs vulnerabilities (Packagist)

4 vulnerabilities.

• drupal/tacjs Packagist tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies CVE-2026-49977 Fix available 4.3 MediumJune 3, 2026
• drupal/tacjs Packagist tarteaucitron.js allows url scheme injection via unfiltered inputs CVE-2025-31476 Fix available 4.8 MediumApril 2, 2025
• drupal/tacjs Packagist TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016 CVE-2024-13252 Fix available 5.4 MediumMarch 27, 2024
• drupal/tacjs Packagist This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability… DRUPAL-CONTRIB-2023-029 Fix available No scoreJune 28, 2023