tarteaucitron.js vulnerabilities
CVEs whose affected-version data names the tarteaucitron.js package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111714Low· 3.1tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling su…
▾ SunlitAmauriC · tarteaucitron.jsvia CVEORG
CVE-2026-111713Medium· 5.4tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as …
▾ SunlitAmauriC · tarteaucitron.jsvia CVEORG