Vulnerability in Amauri Tarteaucitronjs
CVE-2025-48939
tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element, it could clobber the document.currentScript property. This causes the script to resolve incorrectly to an element instead of the <script> tag, leading to unexpected behavior or failure to load the script path correctly. This issue arises because in some browser environments, named DOM elements become properties on the global document object. An attacker with control over the HTML could exploit this to change the CDN domain of tarteaucitron. This issue has been patched in version 1.22.0.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L.
EPSS exploit prediction
EPSS: 0.002 (9.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 9.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
- Amauri Tarteaucitronjs
- Amauric Tarteaucitron.js — versions < 1.22.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-q43x-79jr-cq98 (Exploit, Patch, Vendor Advisory)
- github.com/AmauriC/tarteaucitron.js/commit/230a3b69d363837acfa895823d841e060882… (Patch)
Frequently asked questions
- What is CVE-2025-48939?
- CVE-2025-48939 is a medium-severity vulnerability in Amauri Tarteaucitronjs, classified under CWE-138. CVSS score: 4.2/10. Published 2025-07-03.
- How severe is CVE-2025-48939?
- Medium severity. CVSS v3 base score is 4.2 out of 10.
- Is CVE-2025-48939 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.