CVE-2025-31475

tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where the addOrUpdate function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site's source code or a CMS plugin to manipulate JavaScript object prototypes, leading to potential security risks such as data corruption or unintended code execution. An attacker with high privileges could exploit this vulnerability to modify object prototypes, affecting core JavaScript behavior, cause application crashes or unexpected behavior, or potentially introduce further security vulnerabilities depending on the application's architecture. This vulnerability is fixed in 1.20.1.

• CWE-1321

• https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5bPatch
• https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-4hwx-xcc5-2hfcVendor Advisory

Published

Apr 7, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-3147A vulnerability has been found in PHPGurukul Boat Booking Sy…9.8
• CVE-2025-31470Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2025-31471Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2025-31472Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2025-31473Improper Neutralization of Input During Web Page Generation …5.9
• CVE-2025-31474Cross-Site Request Forgery (CSRF) vulnerability in matthewpr…4.3
• CVE-2025-31476tarteaucitron.js is a compliant and accessible cookie banner…4.8
• CVE-2025-31477The Tauri shell plugin allows access to the system shell. Pr…9.8
• CVE-2025-31478Zulip is an open-source team collaboration tool. Zulip suppo…8.2
• CVE-2025-31479canonical/get-workflow-version-action is a GitHub composite …8.2
• CVE-2025-3148A vulnerability was found in codeprojects Product Management…7.8
• CVE-2025-31480aiven-extras is a PostgreSQL extension. This is a privilege …9.1