Description
A vulnerability was identified in tarteaucitron.js, where user-controlled inputs for element dimensions (width and height) were not properly validated.
Recommendation
Update the tarteaucitronjs package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.20.1
- Patched version(s): 1.20.1
References
Could your website be exposed too?
SmartScanner can check your website for tarteaucitron.js allows UI manipulation via unrestricted CSS injection and gives you actionable findings to investigate.
Start a free scanRelated Issues
- tarteaucitron.js allows prototype pollution via custom text injection - CVE-2025-31475
- tarteaucitron.js allows url scheme injection via unfiltered inputs - CVE-2025-31476
- tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript - CVE-2025-48939
- OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation - CVE-2025-66028
You might also like:
See something that needs correcting? Let us knowUpdated April 07, 2025