tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

Description

A vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element such as:

it could clobber the document.currentScript property.

Recommendation

Update the tarteaucitronjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.22.0
• Patched version(s): 1.22.0

References

• GHSA-q43x-79jr-cq98
• CVE-2025-48939
• CWE-138
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• x402 SDK vulnerable in outdated versions in resource servers for builders - Vulnerability
• tarteaucitron.js allows prototype pollution via custom text injection - CVE-2025-31475
• tarteaucitron.js allows UI manipulation via unrestricted CSS injection - CVE-2025-31138
• tarteaucitron Cross-site Scripting (XSS) - CVE-2025-1467

Tags:

npm

tarteaucitronjs