CVE-2025-31476 tarteaucitron.js allows url scheme injection via unfiltered inputs
High-privilege users can inject malicious JavaScript via insecure URL schemes in tarteaucitron.js, leading to arbitrary code execution and data theft.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-31476?
CVE-2025-31476 is a medium-severity cross-site scripting vulnerability in AmauriC tarteaucitron.js, published on 7 Apr 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert(). Before the fix, URL validation was insufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link. An attacker with high privileges could insert a link exploiting an insecure URL scheme, leading to execution of arbitrary JavaScript code, theft of sensitive data through phishing attacks, or modification of the user interface behavior. This vulnerability is fixed in 1.20.1.
Weakness: CWE-79
Which versions are affected by CVE-2025-31476?
2 open source packages ship an affected version, including tarteaucitronjs. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
tarteaucitronjs npm | All versions | 1.20.1 |
tarteaucitronjs npm | All versions | 1.20.1 |
Linux distribution packages (1)
drupal/tacjs Packagist:https://packages.drupal.org/8 | All versions | 6.7.0 |
Products include Amauri Tarteaucitronjs, Tacjs Project Tacjs.
How do I fix CVE-2025-31476?
Upgrade tarteaucitronjs to 1.20.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-31476 being exploited?
There is no known exploitation of CVE-2025-31476 in the wild and no public exploit code.
Other vulnerabilities in AmauriC tarteaucitron.js
- CVE-2025-31138 tarteaucitron.js allows UI manipulation via unrestricted CSS injection
- CVE-2025-31475 tarteaucitron.js allows prototype pollution via custom text injection
- CVE-2026-22809 tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability
- CVE-2025-48939 tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript
Sources
Also known as DRUPAL-CONTRIB-2025-027, GHSA-p5g4-v748-6fh8.