CVE-2025-31138 tarteaucitron.js allows UI manipulation via unrestricted CSS injection
Attackers can inject CSS to manipulate UI elements, enabling clickjacking and disrupting website functionality in tarteaucitron.js.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-31138?
CVE-2025-31138 is a medium-severity cross-site scripting vulnerability in AmauriC tarteaucitron.js, published on 7 Apr 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allowed an attacker with direct access to the site's source code or a CMS plugin to set values like 100%;height:100%;position:fixed;, potentially covering the entire viewport and facilitating clickjacking attacks. An attacker with high privileges could exploit this vulnerability to overlay malicious UI elements on top of legitimate content, trick users into interacting with hidden elements (clickjacking), or disrupt the intended functionality and accessibility of the website. This vulnerability is fixed in 1.20.1.
Weakness: CWE-1021
Which versions are affected by CVE-2025-31138?
2 open source packages ship an affected version, including tarteaucitronjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tarteaucitronjs npm | All versions | 1.20.1 |
tarteaucitronjs npm | All versions | 1.20.1 |
Products include Amauri Tarteaucitronjs.
How do I fix CVE-2025-31138?
Upgrade tarteaucitronjs to 1.20.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-31138 being exploited?
There is no known exploitation of CVE-2025-31138 in the wild and no public exploit code.
Other vulnerabilities in AmauriC tarteaucitron.js
- CVE-2025-31475 tarteaucitron.js allows prototype pollution via custom text injection
- CVE-2025-31476 tarteaucitron.js allows url scheme injection via unfiltered inputs
- CVE-2026-22809 tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability
- CVE-2025-48939 tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript
Sources
Also known as GHSA-7524-3396-fqv3.