{"id":"CVE-2026-111713","title":"tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch","summary":"tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as …","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"AmauriC","product":"tarteaucitron.js","affected":["tarteaucitron.js >= 1.20.1 < 1.37.0"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T17:40:02.702Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111713","references":[{"url":"https://github.com/AmauriC/tarteaucitron.js/commit/068653bd47f5d4a493251ca8e15bd2b0be9b544f"},{"url":"https://github.com/AmauriC/tarteaucitron.js/releases/tag/v1.37.0","label":"tarteaucitron.js v1.37.0 Release Notes"},{"url":"https://github.com/AmauriC/tarteaucitron.js/blob/v1.36.0/tarteaucitron.js#L2641-L2648"},{"url":"https://github.com/AmauriC/tarteaucitron.js/compare/v1.36.0...v1.37.0"},{"url":"https://www.vulncheck.com/advisories/tarteaucitron-js-before-1.37.0-xss-via-getelemattr-attribute-validation-mismatch","label":"VulnCheck Advisory: tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T18:43:08.639Z","slug":"CVE-2026-111713","body":"## Overview\n\ntarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.\n\n## Affected\n\n- `tarteaucitron.js >= 1.20.1 < 1.37.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}