CVE-2026-49977 tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies
An attacker can delete arbitrary non-HttpOnly cookies by injecting HTML with specific data attributes, requiring user interaction to trigger the deletion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-49977?
CVE-2026-49977 is a medium-severity vulnerability in AmauriC tarteaucitron.js, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by tarteaucitron. If an attacker can write HTML with data attributes, an element with data-cookie can silently delete a non-HttpOnly cookie with a known name when clicked by a user. This issue is fixed in version 1.33.0.
Weakness: CWE-285
Which versions are affected by CVE-2026-49977?
2 open source packages ship an affected version, including tarteaucitronjs.
| Package | Affected | Fixed in |
|---|---|---|
tarteaucitronjs npm | All versions | 1.33.0 |
tarteaucitronjs npm | All versions | 1.33.0 |
Linux distribution packages (1)
drupal/tacjs Packagist:https://packages.drupal.org/8 | All versions | 6.8.0 |
How do I fix CVE-2026-49977?
Upgrade tarteaucitronjs to 1.33.0 or later.
Is CVE-2026-49977 being exploited?
There is no known exploitation of CVE-2026-49977 in the wild and no public exploit code.
Sources
Also known as DRUPAL-CONTRIB-2026-040, GHSA-jxj7-g6gm-49j7.