tarteaucitron.js allows UI manipulation via unrestricted CSS injection

Description

A vulnerability was identified in tarteaucitron.js, where user-controlled inputs for element dimensions (width and height) were not properly validated.

Recommendation

Update the tarteaucitronjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.20.1
• Patched version(s): 1.20.1

References

• GHSA-7524-3396-fqv3
• CVE-2025-31138
• CWE-1021
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Predictable results in nanoid generation when given non-integer values - CVE-2024-55565
• tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript - CVE-2025-48939
• OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer - CVE-2025-50183
• tarteaucitron.js allows url scheme injection via unfiltered inputs - CVE-2025-31476

Tags:

npm

tarteaucitronjs