CVE-2025-48939

tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element, it could clobber the document.currentScript property. This causes the script to resolve incorrectly to an element instead of the <script> tag, leading to unexpected behavior or failure to load the script path correctly. This issue arises because in some browser environments, named DOM elements become properties on the global document object. An attacker with control over the HTML could exploit this to change the CDN domain of tarteaucitron. This issue has been patched in version 1.22.0.

• CWE-138

• https://github.com/AmauriC/tarteaucitron.js/commit/230a3b69d363837acfa895823d841e0608826ba3Patch
• https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-q43x-79jr-cq98Exploit, Patch, Vendor Advisory

Published

Jul 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48931The TeleMessage service through 2025-05-05 relies on MD5 for…5.5
• CVE-2025-48934Deno is a JavaScript, TypeScript, and WebAssembly runtime. P…5.3
• CVE-2025-48935Deno is a JavaScript, TypeScript, and WebAssembly runtime. S…9.1
• CVE-2025-48936Zitadel is open-source identity infrastructure software. Pri…8.8
• CVE-2025-48937matrix-rust-sdk is an implementation of a Matrix client-serv…4.9
• CVE-2025-48938go-gh is a collection of Go modules to make authoring GitHub…9.8
• CVE-2025-4894A vulnerability classified as problematic was found in calmk…5.9
• CVE-2025-48940MyBB is free and open source forum software. Prior to versio…7.2
• CVE-2025-48941MyBB is free and open source forum software. Prior to versio…5.3
• CVE-2025-48942vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48943vLLM is an inference and serving engine for large language m…6.5
• CVE-2025-48944vLLM is an inference and serving engine for large language m…6.5