CVE-2025-31475 tarteaucitron.js allows prototype pollution via custom text injection
Attackers with source code access can inject malicious prototypes in tarteaucitron.js, potentially causing code execution or application crashes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-31475?
CVE-2025-31475 is a medium-severity code injection vulnerability in AmauriC tarteaucitron.js, published on 7 Apr 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where the addOrUpdate function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site's source code or a CMS plugin to manipulate JavaScript object prototypes, leading to potential security risks such as data corruption or unintended code execution. An attacker with high privileges could exploit this vulnerability to modify object prototypes, affecting core JavaScript behavior, cause application crashes or unexpected behavior, or potentially introduce further security vulnerabilities depending on the application's architecture. This vulnerability is fixed in 1.20.1.
Weakness: CWE-1321
Which versions are affected by CVE-2025-31475?
2 open source packages ship an affected version, including tarteaucitronjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tarteaucitronjs npm | All versions | 1.20.1 |
tarteaucitronjs npm | All versions | 1.20.1 |
Products include Amauri Tarteaucitronjs.
How do I fix CVE-2025-31475?
Upgrade tarteaucitronjs to 1.20.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-31475 being exploited?
There is no known exploitation of CVE-2025-31475 in the wild and no public exploit code.
Other vulnerabilities in AmauriC tarteaucitron.js
- CVE-2025-31138 tarteaucitron.js allows UI manipulation via unrestricted CSS injection
- CVE-2025-31476 tarteaucitron.js allows url scheme injection via unfiltered inputs
- CVE-2026-22809 tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability
- CVE-2025-48939 tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript
Sources
Also known as GHSA-4hwx-xcc5-2hfc.