CVE-2025-31476: tarteaucitron.js allows url scheme injection via unfiltered inputs
A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert(). Before the fix, URL validation was insufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link.
Impact An attacker with high privileges could insert a link exploiting an insecure URL scheme, leading to: - Execution of arbitrary JavaScript code - Theft of sensitive data through phishing attacks - Modification of the user interface behavior
Fix https://github.com/AmauriC/tarteaucitron.js/commit/2fa1e01023bce2e4b813200600bb1619d56ceb02 The issue was resolved by enforcing strict URL validation, ensuring that they start with http:// or https:// before being used.
Other sources
tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert(). Before the fix, URL validation was insufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link. An attacker with high privileges could insert a link exploiting an insecure URL scheme, leading to execution of arbitrary JavaScript code, theft of sensitive data through phishing attacks, or modification of the user interface behavior. This vulnerability is fixed in 1.20.1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31476?
CVE-2025-31476 has a medium severity level due to the potential for privilege escalation through the manipulation of URL schemes.
How do I fix CVE-2025-31476?
To fix CVE-2025-31476, update tarteaucitron.js to version 1.20.1 or later.
Who is affected by CVE-2025-31476?
Users who have implemented tarteaucitron.js versions prior to 1.20.1 are vulnerable to CVE-2025-31476.
What could an attacker do with CVE-2025-31476?
An attacker could exploit CVE-2025-31476 to execute arbitrary JavaScript code in the context of the user's browser.
Is CVE-2025-31476 being actively exploited?
As of now, there is no public evidence suggesting that CVE-2025-31476 is actively being exploited in the wild.