TA
Product
tarteaucitron.js
8
CVEs
0
On KEV
6.6
Max CVSS
2
New 30D
Severity mix
Critical 0High 0Medium 7Low 1
Watch
Add tarteaucitron.js to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-31475 | 6.6 | Apr 7 | tarteaucitron.js allows prototype pollution via custom text injection Affected: < 1.20.1 |
| CVE-2025-31138 | 6.6 | Apr 7 | tarteaucitron.js allows UI manipulation via unrestricted CSS injection Affected: < 1.20.1 |
| CVE-2026-111713 | 5.4 | Oct 16 | tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch Affected: 1.20.1 before 1.37.0 |
| CVE-2025-31476 | 4.8 | Apr 7 | tarteaucitron.js allows url scheme injection via unfiltered inputs Affected: < 1.20.1 |
| CVE-2026-22809 | 4.4 | Jan 13 | tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability Affected: < 1.29.0 |
| CVE-2026-49977 | 4.3 | Jul 17 | tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies Affected: < 1.33.0 |
| CVE-2025-48939 | 4.2 | Jul 3 | tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript Affected: < 1.22.0 |
| CVE-2026-111714 | 3.1 | Oct 16 | tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge Affected: before 1.37.0 |
Showing 8