tarteaucitron.js allows prototype pollution via custom text injection

Description

A vulnerability was identified in tarteaucitron.js, where the addOrUpdate function, used for applying custom texts, did not properly validate input.

Recommendation

Update the tarteaucitronjs package to the latest compatible version. Followings are version details:

Affected version(s): < 1.20.1
Patched version(s): 1.20.1

References

GHSA-4hwx-xcc5-2hfc
CVE-2025-31475
CWE-1321
CAPEC-310
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for tarteaucitron.js allows prototype pollution via custom text injection and gives you actionable findings to investigate.

Start a free scan

Related Issues

tarteaucitron.js allows UI manipulation via unrestricted CSS injection - CVE-2025-31138
tarteaucitron.js allows url scheme injection via unfiltered inputs - CVE-2025-31476
Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) - CVE-2025-8101
billboard.js allows prototype pollution via the function generate - CVE-2025-49223

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

See something that needs correcting? Let us knowUpdated April 07, 2025