CVE-2026-111713: tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tarteaucitron.jsto a version that resolves this vulnerability.Fixed in 1.37.0
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
An attacker needs the ability to place markup in content processed by tarteaucitron.js, such as a CMS author. The attack also requires a victim to interact with the crafted content.
What markup condition triggers the vulnerability?
The attacker can supply a data-url attribute containing a javascript: URL alongside a benign unprefixed url attribute. The unprefixed attribute passes the HTTPS-only validation, while getElemAttr resolves the data-url value for the iframe src.
Which versions should be remediated?
Versions before 1.37.0 are affected. Update tarteaucitron.js to version 1.37.0 or later.