Description
A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site’s source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert().
Recommendation
Update the tarteaucitronjs package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.20.1
- Patched version(s): 1.20.1
References
Could your website be exposed too?
SmartScanner can check your website for tarteaucitron.js allows url scheme injection via unfiltered inputs and gives you actionable findings to investigate.
Start a free scanRelated Issues
- tarteaucitron.js allows prototype pollution via custom text injection - CVE-2025-31475
- tarteaucitron.js allows UI manipulation via unrestricted CSS injection - CVE-2025-31138
- tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript - CVE-2025-48939
- Trix allows Cross-site Scripting via `javascript:` url in a link - CVE-2025-21610
You might also like:
See something that needs correcting? Let us knowUpdated April 07, 2025