EUVD-2026-45318
GHSA-jxj7-g6gm-49j7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
AC:H reflects the compound requirement of knowing the exact target cookie name and confirming it lacks HttpOnly; all other metrics align with the provided vector.
Primary rating from Vendor (https://github.com/AmauriC/tarteaucitron.js).
CVSS VectorVendor: https://github.com/AmauriC/tarteaucitron.js
Lifecycle Timeline
1DescriptionCVE.org
Summary
tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element that silently deletes a cookie when clicked and trick a user to delete this cookie.
Details
tarteaucitron.cookie.purge() is called on any element with the purgeBtn class. It does not check if the element is a legitimate tarteaucitron button or if the cookie corresponds to a service handled by tarteaucitron.
PoC
<a class="purgeBtn" data-cookie="foo">Click me!</a>If someone has a cookie with this name and clicks on the link, the cookie is silently deleted.
Impact
The impact is limited because this only works on cookies without HttpOnly=true and the attacker has to know the name of the cookie.
AnalysisAI
Cookie deletion via unauthorized class-based invocation in tarteaucitron.js allows an attacker with HTML injection capability to silently delete browser cookies by placing arbitrary elements bearing the purgeBtn CSS class in a page that loads the library. The tarteaucitron.cookie.purge() function responds to any matching DOM element without verifying whether it was created by the library itself or whether the specified cookie belongs to a tarteaucitron-managed service, enabling targeted cookie removal against visitors who interact with the crafted element. No public exploit identified at time of analysis beyond the researcher-published PoC; this vulnerability is not listed in CISA KEV and EPSS data is unavailable.
Technical ContextAI
tarteaucitron.js (npm package: tarteaucitronjs, sourced from https://github.com/AmauriC/tarteaucitron.js) is a JavaScript library for GDPR-compliant cookie consent management, widely adopted on European websites. The root cause, classified as CWE-285 (Improper Authorization), lies in the event-binding architecture of tarteaucitron.cookie.purge(): the function is attached to any DOM element matching the purgeBtn CSS class rather than to a controlled set of internally-created elements. Because CSS class names are not access-controlled, an attacker who can inject HTML with arbitrary class and data-* attributes - via stored XSS, unsanitized user-generated content rendering, markdown injection, or similar vectors - can manufacture a triggering element. The data-cookie attribute value is passed directly to the purge function, which then deletes the named cookie without validating its origin or scope.
RemediationAI
Consult the upstream GitHub advisory at https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-jxj7-g6gm-49j7 for a patched release; no specific fixed version is confirmed from the available intelligence data, so fix status must be verified directly with the maintainer. As an immediate compensating control, ensure all security-sensitive cookies (session tokens, authentication identifiers) are set with the HttpOnly flag, which prevents JavaScript from reading or deleting them and fully blocks this attack vector for those cookies - this is GDPR and security best practice regardless of this vulnerability. Additionally, audit the application for HTML injection vectors (comment fields, user-generated content, markdown renderers) that could allow attacker-controlled elements to reach the DOM on pages that load tarteaucitron.js; eliminating the injection vector removes the exploitation path entirely. The upstream fix should scope the purgeBtn listener to elements generated within the tarteaucitron initialization routine rather than all class-matching DOM elements.
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today