Skip to contentAmauric Tarteaucitron.js vulnerabilities
- amauric tarteaucitron.jstarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purgeCVE-2026-1117142.3 Low
- amauric tarteaucitron.jstarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation MismatchCVE-2026-1117135.1 Medium
- amauric tarteaucitron.jstarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookiesCVE-2026-49977Fix available4.3 Medium
- amauric tarteaucitron.js, amauri tarteaucitronjs +1 moretarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerabilityCVE-2026-22809Fix available4.4 Medium
- amauric tarteaucitron.js, amauri tarteaucitronjs +1 moretarteaucitron.js vulnerable to DOM Clobbering via document.currentScriptCVE-2025-48939Fix available4.2 Medium
- amauric tarteaucitron.js, amauri tarteaucitronjs +1 moretarteaucitron.js allows prototype pollution via custom text injectionCVE-2025-31475Fix available5.5 Medium
- amauric tarteaucitron.js, amauri tarteaucitronjs +1 moretarteaucitron.js allows UI manipulation via unrestricted CSS injectionCVE-2025-31138Fix available5.5 Medium
- amauric tarteaucitron.js, amauri tarteaucitronjs, tacjs project tacjs +2 moretarteaucitron.js allows url scheme injection via unfiltered inputsCVE-2025-31476Fix available4.8 Medium
- amauric amauric/tarteaucitron.js, tarteaucitron +1 moreCross-site Scripting (XSS) - Stored in amauric/tarteaucitron.jsCVE-2023-3620Fix available4.6 Medium