Description
A vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element such as:
it could clobber the document.currentScript property.
Recommendation
Update the tarteaucitronjs package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.22.0
- Patched version(s): 1.22.0
References
Could your website be exposed too?
SmartScanner can check your website for tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State - CVE-2026-42573
- tarteaucitron.js allows url scheme injection via unfiltered inputs - CVE-2025-31476
- tarteaucitron.js allows prototype pollution via custom text injection - CVE-2025-31475
- Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE - CVE-2025-64495
You might also like:
See something that needs correcting? Let us knowUpdated July 03, 2025