tarteaucitron.js allows UI manipulation via unrestricted CSS injection

Description

A vulnerability was identified in tarteaucitron.js, where user-controlled inputs for element dimensions (width and height) were not properly validated.

Recommendation

Update the tarteaucitronjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.20.1
• Patched version(s): 1.20.1

References

• GHSA-7524-3396-fqv3
• CVE-2025-31138
• CWE-1021
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• HackMD MCP Server has Server-Side Request Forgery (SSRF) vulnerability - CVE-2025-59155
• OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer - CVE-2025-50183
• tarteaucitron.js allows url scheme injection via unfiltered inputs - CVE-2025-31476
• tarteaucitron.js allows prototype pollution via custom text injection - CVE-2025-31475

Tags:

npm

tarteaucitronjs