CVE-2025-48939 tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript
An attacker can manipulate DOM elements to alter the script's CDN domain, potentially bypassing security controls or causing script loading failures.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-48939?
CVE-2025-48939 is a medium-severity vulnerability in AmauriC tarteaucitron.js, published on 3 Jul 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element, it could clobber the document.currentScript property. This causes the script to resolve incorrectly to an element instead of the <script> tag, leading to unexpected behavior or failure to load the script path correctly. This issue arises because in some browser environments, named DOM elements become properties on the global document object. An attacker with control over the HTML could exploit this to change the CDN domain of tarteaucitron. This issue has been patched in version 1.22.0.
Weakness: CWE-138
Which versions are affected by CVE-2025-48939?
2 open source packages ship an affected version, including tarteaucitronjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tarteaucitronjs npm | All versions | 1.22.0 |
tarteaucitronjs npm | All versions | 1.22.0 |
Products include Amauri Tarteaucitronjs.
How do I fix CVE-2025-48939?
Upgrade tarteaucitronjs to 1.22.0 or later.
Is CVE-2025-48939 being exploited?
There is no known exploitation of CVE-2025-48939 in the wild and no public exploit code.
Other vulnerabilities in AmauriC tarteaucitron.js
- CVE-2025-31138 tarteaucitron.js allows UI manipulation via unrestricted CSS injection
- CVE-2025-31475 tarteaucitron.js allows prototype pollution via custom text injection
- CVE-2025-31476 tarteaucitron.js allows url scheme injection via unfiltered inputs
- CVE-2026-22809 tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability
Sources
Also known as GHSA-q43x-79jr-cq98.