Read the docs
TI-2026-75499 Aliases CVE-2026-111713GHSA-rfp9-xrhw-w637

Cross-site scripting in tarteaucitron.js via data-url attribute

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

tarteaucitron.js from 1.20.1 before 1.37.0 by AmauriC contains a cross-site scripting flaw (CWE-79) because getElemAttr reads 'data-' prefixed attributes while the https-only guard checks the unprefixed attribute. An attacker who can place markup, such as a CMS author, can add a data-url attribute with a javascript: URL beside a benign url, which runs script in the site's origin through an iframe src. The CVSS 4.0 vector indicates network access with low privileges and passive user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00171 6th percentileScored 2026-11-07
Fix Fixed tarteaucitron.js (AmauriC): 1.37.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AmauriCtarteaucitron.js1.20.1 to before 1.37.01.37.0Patch availableCNA
  • tarteaucitron.js VendorAmauriC Affected 1.20.1 to before 1.37.0 Fixed in 1.37.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:amauri:tarteaucitronjs:*:*:*:*:*:*:*:*——AmauriC
  • cpe:2.3:a:amauri:tarteaucitronjs:*:*:*:*:*:*:*:* Versions — — ·AmauriC

Remediation

Update tarteaucitron.js to version 1.37.0 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA tarteaucitron.js (AmauriC) Fixed in 1.37.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    AmauriC tarteaucitron.js 1.37.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-75500 Regular expression denial of service in tarteaucitron.js cookie purgePriority LOW 11
    Show all 2 records →

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111713
  2. 2026-10-16 Alias added: GHSA-rfp9-xrhw-w637
  3. 2026-10-20 CISA SSVC decision points changed

References

Patch 1

Other 3

  • TI-2023-03379 Cross-site Scripting (XSS) - Stored in amauric/tarteaucitron.js CVSS 3.1MEDIUM 5.4
  • TI-2025-04443 tarteaucitron.io < 1.9.5 - Contributor+ Stored XSS CVSS 3.1MEDIUM 4.7
  • TI-2026-65941 WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter CVSS 3.1CRITICAL 9.8
  • TI-2026-44356 WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5
  • TI-2024-11523 WPMobile.App — Android and iOS Mobile Application <= 11.52 - Unauthenticated Arbitrary Shortcode Execution CVSS 3.1MEDIUM 6.5
  • TI-2024-12908 WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter CVSS 3.1HIGH 7.2
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences