tarteaucitron.js vulnerable to Cross-site Scripting

Description

Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.

Recommendation

Update the tarteaucitronjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.13.1
• Patched version(s): 1.13.1

References

• GHSA-f44m-65h3-99vc
• huntr.dev
• CVE-2023-3620
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) - CVE-2020-8203
• tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript - CVE-2025-48939
• Cross-site Scripting (XSS) in serialize-javascript - CVE-2024-11831
• QMarkdown Cross-Site Scripting (XSS) vulnerability - CVE-2025-43954

Tags:

npm

tarteaucitronjs