CVE-2026-111713
Received Received - Intake

Cross-Site Scripting in tarteaucitron.js via data-url Attribute

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111713
EUVD
EUVD-2026-103005

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
AmauriC tarteaucitron.js 1.20.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

tarteaucitron.js before version 1.37.0 has a cross-site scripting flaw in the getElemAttr function. It improperly resolves attributes prefixed with 'data-' while validating unprefixed attributes for HTTPS-only usage. Attackers with markup placement ability can inject a data-url with a javascript: URL alongside a legitimate URL to execute malicious scripts in the site's origin via an iframe src.

Detection Guidance

To detect this vulnerability, inspect instances of tarteaucitron.js for versions before 1.37.0. Check for data-url attributes containing javascript: URLs in iframes or other elements. Manually review JavaScript files and DOM elements for suspicious markup patterns.

Impact Analysis

If you use tarteaucitron.js versions before 1.37.0, attackers could execute arbitrary JavaScript in your site's context. This could lead to theft of user sessions, defacement, or delivery of malware to your users. CMS authors or other trusted users with markup access are potential attack vectors.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized script execution that processes user data without consent. For HIPAA, it may allow access to protected health information if scripts interact with medical data systems. Compliance requires patching to prevent such unauthorized code execution.

Mitigation Strategies

Upgrade tarteaucitron.js to version 1.37.0 or later. Remove or sanitize any data-url attributes with javascript: URLs. Implement input validation for user-generated content to prevent malicious markup injection.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111713. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart