Skip to content
Fencer Vulns
medium 4.2

CVE-2025-48939 json

tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

published 2025-07-03 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-19885 , GHSA-q43x-79jr-cq98

cvss
4.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element, it could clobber the document.currentScript property. This causes the script to resolve incorrectly to an element instead of the <script> tag, leading to unexpected behavior or failure to load the script path correctly. This issue arises because in some browser environments, named DOM elements become properties on the global document object. An attacker with control over the HTML could exploit this to change the CDN domain of tarteaucitron. This issue has been patched in version 1.22.0.

Patch / fix

  • npm tarteaucitronjs 1.22.0
  • amauri tarteaucitronjs 1.22.0
  • tarteaucitron tarteaucitron 1.22.0

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
16 mo ago

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-q43x-79jr-cq98 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L
GitHub 3.1 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L

Affected packages

ecosystem package affected fixed in
npm tarteaucitronjs
<1.22.0
1.22.0

Affected products

  • AmauriC tarteaucitron.js

Classification

Weakness
  • CWE-138 Improper Neutralization of Special Elements

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.