tarteaucitron.js allows prototype pollution via custom text injection

Description

A vulnerability was identified in tarteaucitron.js, where the addOrUpdate function, used for applying custom texts, did not properly validate input.

Recommendation

Update the tarteaucitronjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.20.1
• Patched version(s): 1.20.1

References

• GHSA-4hwx-xcc5-2hfc
• CVE-2025-31475
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• tarteaucitron.js allows UI manipulation via unrestricted CSS injection - CVE-2025-31138
• tarteaucitron.js allows url scheme injection via unfiltered inputs - CVE-2025-31476
• billboard.js allows prototype pollution via the function generate - CVE-2025-49223
• Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) - CVE-2025-8101

Tags:

npm

tarteaucitronjs