---
id: CVE-2026-49977
aliases:
  - GHSA-jxj7-g6gm-49j7
title: 'tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies'
summary: 'tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies'
severity: medium
cvss: 4.3
cwe:
  - CWE-285
vendor: tarteaucitronjs
product: tarteaucitronjs
ecosystem: npm
affected:
  - tarteaucitronjs < 1.33.0
patched:
  - tarteaucitronjs 1.33.0
published: '2026-07-10'
updated: '2026-07-10'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-jxj7-g6gm-49j7'
references:
  - url: >-
      https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-jxj7-g6gm-49j7
  - url: 'https://github.com/advisories/GHSA-jxj7-g6gm-49j7'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-10T16:05:09.796Z'
epss: 0.00354
epssPercentile: 0.26439
---

## Overview

### Summary

tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element that silently deletes a cookie when clicked and trick a user to delete this cookie.

### Details

`tarteaucitron.cookie.purge()` is called on any element with the `purgeBtn` class. It does not check if the element is a legitimate tarteaucitron button or if the cookie corresponds to a service handled by tarteaucitron.

### PoC

```html
<a class="purgeBtn" data-cookie="foo">Click me!</a>
```

If someone has a cookie with this name and clicks on the link, the cookie is silently deleted.

### Impact

The impact is limited because this only works on cookies without HttpOnly=true and the attacker has to know the name of the cookie.

## Affected packages

- `tarteaucitronjs < 1.33.0`

## Remediation

Upgrade to a patched release:

- `tarteaucitronjs 1.33.0`