CVE-2026-22809: falha de média gravidade em AmauriC tarteaucitron.js
tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.4epss 0.1%
tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the issuu_id parameter. This vulnerability is fixed in 1.29.0.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
AmauriC · tarteaucitron.jsCVEs relacionadas — AmauriC tarteaucitron.js
No mesmo produto, das mais perigosas para as menos.
CVE-2025-31476MEDIUMtarteaucitron.js allows url scheme injection via unfiltered inputsEPSS 0.4%CVE-2026-49977MEDIUMtarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookiesEPSS 0.4%CVE-2025-31475MEDIUMtarteaucitron.js allows prototype pollution via custom text injectionEPSS 0.4%CVE-2025-31138MEDIUMtarteaucitron.js allows UI manipulation via unrestricted CSS injectionEPSS 0.3%CVE-2026-111714LOWtarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purgeEPSS 0.2%CVE-2025-48939MEDIUMtarteaucitron.js vulnerable to DOM Clobbering via document.currentScriptEPSS 0.2%