tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

Description

A vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element such as:

it could clobber the document.currentScript property.

Recommendation

Update the tarteaucitronjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.22.0
• Patched version(s): 1.22.0

References

• GHSA-q43x-79jr-cq98
• CVE-2025-48939
• CWE-138
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• tarteaucitron.js allows UI manipulation via unrestricted CSS injection - CVE-2025-31138
• tarteaucitron.js allows url scheme injection via unfiltered inputs - CVE-2025-31476
• tarteaucitron.js allows prototype pollution via custom text injection - CVE-2025-31475
• Signal K Server Vulnerable to Denial of Service via Unrestricted Access Request Flooding - CVE-2025-68272

Tags:

npm

tarteaucitronjs