CVE-2026-49977
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Vulnerability in tarteaucitron.js before version 1.33.0. The tarteaucitron.cookie.purge() function is called on any element with the purgeBtn class without checking if it is a legitimate tarteaucitron button. An attacker can delete a non-HttpOnly cookie with a known name via user click.
Risk Assessment
Risk of cookie deletion leading to session loss or other functionality issues.
Recommendation
Upgrade tarteaucitron.js to version 1.33.0 or later.
Other vulnerabilities in tarteaucitron.js
See all- CVE-2026-111714Low
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a purgeBtn element with a catastrophic-backtracking data-cookie pattern that freezes the page when the purge button is clicked.
- CVE-2026-111713Medium
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.
Original NVD description (English source)
tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by tarteaucitron. If an attacker can write HTML with data attributes, an element with data-cookie can silently delete a non-HttpOnly cookie with a known name when clicked by a user. This issue is fixed in version 1.33.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS