tarteaucitron.js allows url scheme injection via unfiltered inputs

Description

A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site’s source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert().

Recommendation

Update the tarteaucitronjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.20.1
• Patched version(s): 1.20.1

References

• GHSA-p5g4-v748-6fh8
• CVE-2025-31476
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival - CVE-2025-59414
• Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) - CVE-2025-8101
• tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript - CVE-2025-48939
• Marked allows Regular Expression Denial of Service (ReDoS) attacks - CVE-2018-25110

Tags:

npm

tarteaucitronjs