CVE-2025-48939

Katalog CVE

CVSS 4.2 · Medium EPSS 0,20%

Kerentanan Improper Neutralization of Special Elements pada amauri tarteaucitronjs. Skor CVSS 3.1 4.2 (Medium) menurut github.com.

Deskripsi (NVD)

tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element, it could clobber the document.currentScript property. This causes the script to resolve incorrectly to an element instead of the <script> tag, leading to unexpected behavior or failure to load the script path correctly. This issue arises because in some browser environments, named DOM elements become properties on the global document object. An attacker with control over the HTML could exploit this to change the CDN domain of tarteaucitron. This issue has been patched in version 1.22.0.

Rincian

Terbit di NVD

3 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.2 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-138: Improper Neutralization of Special Elements

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-q43x-79jr-cq98 exploit · patch · advisory vendor
• https://github.com/AmauriC/tarteaucitron.js/commit/230a3b69d363837acfa895823d841e0608826ba3 patch