DOM Clobbering Affecting tarteaucitronjs package, versions <1.22.0


Severity

Recommended
0.0
low
0
10

CVSS assessment by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of Concept

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-JS-TARTEAUCITRONJS-10598341
  • published4 Jul 2025
  • disclosed3 Jul 2025
  • creditPierre Rudloff

Introduced: 3 Jul 2025

NewCVE-2025-48939  (opens in a new tab)
CWE-138  (opens in a new tab)

How to fix?

Upgrade tarteaucitronjs to version 1.22.0 or higher.

Overview

tarteaucitronjs is a package that provides compliance to the European cookie law.

Affected versions of this package are vulnerable to DOM Clobbering when setting the document.currentScript value. An attacker can cause incorrect script resolution and potentially alter the CDN domain by injecting a DOM element with a conflicting name attribute.

PoC

<img name="currentScript" src="https://malicious.example.com">

References

CVSS Base Scores

version 4.0
version 3.1