CVE-2026-49977Medium· 4.3▾ Sunlittarteaucitron: data-cookie attribute can be used to delete arbitrary cookies
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.3%
0.3% → 0.4%
tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element that silently deletes a cookie when clicked and trick a user to delete this cookie.
tarteaucitron.cookie.purge() is called on any element with the purgeBtn class. It does not check if the element is a legitimate tarteaucitron button or if the cookie corresponds to a service handled by tarteaucitron.
<a class="purgeBtn" data-cookie="foo">Click me!</a>
If someone has a cookie with this name and clicks on the link, the cookie is silently deleted.
The impact is limited because this only works on cookies without HttpOnly=true and the attacker has to know the name of the cookie.
tarteaucitronjs < 1.33.0Upgrade to a patched release:
tarteaucitronjs 1.33.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-70472High· 8.8Flowise is a drag & drop user interface to build a customized large language model flow
CVE-2026-64642HighNext.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale
CVE-2026-53515High· 7.1@better-auth/sso: SSO provider may allow registration for any org member without a checking their role
CVE-2026-46700Medium· 4.3@actual-app/sync-server's missing authorization on GET /secret/:name allows non-admin OpenID users to enumerate admin-configured bank-sync secrets
CVE-2026-53851Medium· 5.3OpenClaw: Slack reaction events could ignore reaction notification settings
CVE-2026-10030High· 7.1IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks.