CVE-2026-49977: fallo de gravedad media en AmauriC tarteaucitron.js
tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.3epss 0.4%
tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by tarteaucitron. If an attacker can write HTML with data attributes, an element with data-cookie can silently delete a non-HttpOnly cookie with a known name when clicked by a user. This issue is fixed in version 1.33.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Productos afectados
AmauriC · tarteaucitron.jsCVEs relacionadas — AmauriC tarteaucitron.js
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-31476MEDIUMtarteaucitron.js allows url scheme injection via unfiltered inputsEPSS 0.4%CVE-2025-31475MEDIUMtarteaucitron.js allows prototype pollution via custom text injectionEPSS 0.4%CVE-2025-31138MEDIUMtarteaucitron.js allows UI manipulation via unrestricted CSS injectionEPSS 0.3%CVE-2026-111714LOWtarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purgeEPSS 0.2%CVE-2025-48939MEDIUMtarteaucitron.js vulnerable to DOM Clobbering via document.currentScriptEPSS 0.2%CVE-2026-111713MEDIUMtarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation MismatchEPSS 0.2%