Tarteaucitron Js
Monthly
Client-side page freezing in tarteaucitron.js before 1.37.0 allows an attacker to hang a visitor's browser tab by forcing the cookie-purge routine to evaluate a catastrophic-backtracking regular expression built from an unescaped cookie name. The library constructs a RegExp from each cookie name without escaping regex metacharacters, so a name planted as a cookie on a sibling subdomain, or supplied through an injected purgeBtn element's data-cookie attribute, can drive exponential backtracking when the purge action runs. Exploitation is unauthenticated per the CVSS vector (PR:N) but is heavily constrained: it requires an attacker-controlled cookie name (or DOM injection) plus the victim actually clicking the purge control, and the only consequence is a frozen page - no confidentiality or integrity impact. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is assessed as low priority (CVSS 4.0 base 2.3; independently assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).
A stored/DOM cross-site scripting flaw in tarteaucitron.js (CWE-79) affects all releases before 1.37.0 and allows an attacker who can place markup on a page - for example a CMS author or contributor - to inject a 'data-url' or 'data-src' attribute holding a javascript: URL next to a benign-looking 'url' attribute. Because getElemAttr resolves the 'data-' prefixed attribute into an iframe src while the https-only regex guard validates the unprefixed attribute, the javascript: scheme is never rejected and the injected script executes in the site's origin. The vendor rates this Medium (CVSS 5.1, 4.0 vector), our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, and there is no public exploit identified at time of analysis; the authoring-privilege (PR:L) and victim-interaction (UI:P/UI:R) prerequisites limit realistic abuse to multi-author or user-generated-content environments.
Client-side page freezing in tarteaucitron.js before 1.37.0 allows an attacker to hang a visitor's browser tab by forcing the cookie-purge routine to evaluate a catastrophic-backtracking regular expression built from an unescaped cookie name. The library constructs a RegExp from each cookie name without escaping regex metacharacters, so a name planted as a cookie on a sibling subdomain, or supplied through an injected purgeBtn element's data-cookie attribute, can drive exponential backtracking when the purge action runs. Exploitation is unauthenticated per the CVSS vector (PR:N) but is heavily constrained: it requires an attacker-controlled cookie name (or DOM injection) plus the victim actually clicking the purge control, and the only consequence is a frozen page - no confidentiality or integrity impact. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the issue is assessed as low priority (CVSS 4.0 base 2.3; independently assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).
A stored/DOM cross-site scripting flaw in tarteaucitron.js (CWE-79) affects all releases before 1.37.0 and allows an attacker who can place markup on a page - for example a CMS author or contributor - to inject a 'data-url' or 'data-src' attribute holding a javascript: URL next to a benign-looking 'url' attribute. Because getElemAttr resolves the 'data-' prefixed attribute into an iframe src while the https-only regex guard validates the unprefixed attribute, the javascript: scheme is never rejected and the injected script executes in the site's origin. The vendor rates this Medium (CVSS 5.1, 4.0 vector), our independent assessment scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, and there is no public exploit identified at time of analysis; the authoring-privilege (PR:L) and victim-interaction (UI:P/UI:R) prerequisites limit realistic abuse to multi-author or user-generated-content environments.