tarteaucitron.js EUVD-2026-103005

Exploitation requires the attacker to place markup processed by tarteaucitron.js, specifically an element bearing a 'data-url' or 'data-src' attribute whose value is a javascript: URL supplied alongside a legitimate-looking unprefixed 'url' attribute; getElemAttr resolves the data-prefixed attribute into an iframe src while the https-only regex guard validates the wrong (unprefixed) attribute, so the javascript: scheme is never rejected. Concrete prerequisites: (1) the site runs tarteaucitron.js before version 1.37.0; (2) the attacker holds content-authoring/markup-injection capability such as a CMS author or contributor role (not anonymous - PR:L); and (3) a victim must load the affected page (UI:P). These authoring-privilege and user-interaction requirements meaningfully limit real-world exploitation to multi-author or user-generated-content environments.

This is a stored/DOM cross-site scripting flaw (CWE-79) rated Medium (CVSS 5.1, vendor 4.0 vector AV:N/AC:L/PR:L/UI:P). The signals are internally consistent and point to a moderate, not critical, priority. Attack vector is network (AV:N) with low complexity (AC:L), but exploitation is gated by two real limiting factors: PR:L means the attacker must already hold a privileged content-authoring role (the description names CMS authors), and UI:P means a victim must load the affected page. Impact is only partial (VC:L/VI:L, no availability), reflecting script execution in the site origin rather than full system compromise. No EPSS score was provided, the CVE is NOT on CISA KEV, and no public exploit code was identified - so there is no evidence of active or widespread exploitation. The primary risk is to multi-author CMS deployments where a low-trust contributor can abuse a confused-deputy validation gap. Because the trigger requires attacker-controlled markup, this behaves more like a privilege-boundary/stored-XSS issue than an anonymous remote RCE; treat it as a routine-to-prompt patch rather than an emergency. Note: the source vector is CVSS 4.0 only; no CVSS 3.1 vector or EPSS was supplied, so cross-framework comparison relies on the single provided 4.0 vector.

A malicious or compromised CMS author adds a tarteaucitron service element carrying a benign 'url' attribute alongside a 'data-url' (or 'data-src') set to a javascript: URL. Because getElemAttr resolves the data-prefixed attribute while the https-only guard validates the unprefixed one, the javascript: payload bypasses the check and is placed into an iframe src, executing in the site's origin when any visitor loads the page. No public exploit code was identified, though the patch commit publicly reveals the single-line validation mismatch that makes the flaw trivial to reproduce.