tarteaucitron.js allows url scheme injection via unfiltered inputs

Description

A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site’s source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert().

Recommendation

Update the tarteaucitronjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.20.1
• Patched version(s): 1.20.1

References

• GHSA-p5g4-v748-6fh8
• CVE-2025-31476
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• tarteaucitron.js allows UI manipulation via unrestricted CSS injection - CVE-2025-31138
• tarteaucitron.js allows prototype pollution via custom text injection - CVE-2025-31475
• tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript - CVE-2025-48939
• Trix allows Cross-site Scripting via `javascript:` url in a link - CVE-2025-21610

Tags:

npm

tarteaucitronjs