CVE-2025-31138

tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allowed an attacker with direct access to the site's source code or a CMS plugin to set values like 100%;height:100%;position:fixed;, potentially covering the entire viewport and facilitating clickjacking attacks. An attacker with high privileges could exploit this vulnerability to overlay malicious UI elements on top of legitimate content, trick users into interacting with hidden elements (clickjacking), or disrupt the intended functionality and accessibility of the website. This vulnerability is fixed in 1.20.1.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07	Patch
https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-7524-3396-fqv3	Vendor Advisory Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:amauri:tarteaucitronjs:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2025-04-07 15:15

Updated : 2025-10-21 13:55

NVD link : CVE-2025-31138

Mitre link : CVE-2025-31138

CVE.ORG link : CVE-2025-31138

JSON object : View

Products Affected

amauri

tarteaucitronjs

CWE

CWE-1021

Improper Restriction of Rendered UI Layers or Frames

{"id": "CVE-2025-31138", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.3}]}, "published": "2025-04-07T15:15:44.047", "references": [{"url": "https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-7524-3396-fqv3", "tags": ["Vendor Advisory", "Patch"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-1021"}]}], "descriptions": [{"lang": "en", "value": "tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allowed an attacker with direct access to the site's source code or a CMS plugin to set values like 100%;height:100%;position:fixed;, potentially covering the entire viewport and facilitating clickjacking attacks. An attacker with high privileges could exploit this vulnerability to overlay malicious UI elements on top of legitimate content, trick users into interacting with hidden elements (clickjacking), or disrupt the intended functionality and accessibility of the website. This vulnerability is fixed in 1.20.1."}, {"lang": "es", "value": "tarteaucitron.js es un banner de cookies compatible y accesible. Se identific\u00f3 una vulnerabilidad en tarteaucitron.js antes de la versi\u00f3n 1.20.1, donde las entradas controladas por el usuario para las dimensiones de los elementos (ancho y alto) no se validaban correctamente. Esto permit\u00eda a un atacante con acceso directo al c\u00f3digo fuente del sitio o a un complemento de CMS establecer valores como 100%;height:100%;position:fixed;, lo que podr\u00eda cubrir toda la ventana gr\u00e1fica y facilitar ataques de clickjacking. Un atacante con privilegios elevados podr\u00eda explotar esta vulnerabilidad para superponer elementos maliciosos de la interfaz de usuario sobre contenido leg\u00edtimo, enga\u00f1ar a los usuarios para que interact\u00faen con elementos ocultos (clickjacking) o interrumpir la funcionalidad y la accesibilidad previstas del sitio web. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 1.20.1."}], "lastModified": "2025-10-21T13:55:56.330", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:amauri:tarteaucitronjs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "ECAC1B54-E872-41FB-841F-E8590B2A9512", "versionEndExcluding": "1.20.1"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}