{"id":"CVE-2026-49977","aliases":["GHSA-jxj7-g6gm-49j7"],"title":"tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies","summary":"tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies","severity":"medium","cvss":4.3,"cwe":["CWE-285"],"vendor":"tarteaucitronjs","product":"tarteaucitronjs","ecosystem":"npm","affected":["tarteaucitronjs < 1.33.0"],"patched":["tarteaucitronjs 1.33.0"],"published":"2026-07-10","updated":"2026-07-10","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-jxj7-g6gm-49j7","references":[{"url":"https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-jxj7-g6gm-49j7"},{"url":"https://github.com/advisories/GHSA-jxj7-g6gm-49j7"}],"tags":["ghsa","npm"],"ingestedAt":"2026-07-10T16:05:09.796Z","epss":0.00354,"epssPercentile":0.29177,"slug":"CVE-2026-49977","body":"## Overview\n\n### Summary\n\ntarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element that silently deletes a cookie when clicked and trick a user to delete this cookie.\n\n### Details\n\n`tarteaucitron.cookie.purge()` is called on any element with the `purgeBtn` class. It does not check if the element is a legitimate tarteaucitron button or if the cookie corresponds to a service handled by tarteaucitron.\n\n### PoC\n\n```html\n<a class=\"purgeBtn\" data-cookie=\"foo\">Click me!</a>\n```\n\nIf someone has a cookie with this name and clicks on the link, the cookie is silently deleted.\n\n### Impact\n\nThe impact is limited because this only works on cookies without HttpOnly=true and the attacker has to know the name of the cookie.\n\n## Affected packages\n\n- `tarteaucitronjs < 1.33.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `tarteaucitronjs 1.33.0`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}