Cross-Site Scripting in tarteaucitron.js Version Prior to 1.37.0 by AmauriC

CVE-2026-111713

What is CVE-2026-111713?

The tarteaucitron.js library prior to version 1.37.0 is susceptible to a Cross-Site Scripting vulnerability due to an inconsistency in how it validates 'data-' prefixed attributes with the https-only enforcement for unprefixed attributes. This flaw can be exploited by malicious actors, particularly by those who manage the content management system, allowing them to inject a ‘data-url’ attribute containing a harmful JavaScript URL alongside a legitimate one. This could lead to the execution of unauthorized scripts within the site’s origin through an iframe, posing serious security risks.

References