CVE-2025-31138

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-31138
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-31138.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-31138
Aliases
Published
2025-04-07T14:44:40.370Z
Modified
2026-03-13T15:01:11.237047Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
tarteaucitron.js allows UI manipulation via unrestricted CSS injection
Details

tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allowed an attacker with direct access to the site's source code or a CMS plugin to set values like 100%;height:100%;position:fixed;, potentially covering the entire viewport and facilitating clickjacking attacks. An attacker with high privileges could exploit this vulnerability to overlay malicious UI elements on top of legitimate content, trick users into interacting with hidden elements (clickjacking), or disrupt the intended functionality and accessibility of the website. This vulnerability is fixed in 1.20.1.

Database specific 
{
    "cwe_ids": [
        "CWE-1021"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31138.json"
}
References

Affected packages

Git / github.com/AmauriC/tarteaucitron.js

Affected ranges

Type
GIT
Repo
https://github.com/AmauriC/tarteaucitron.js
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
034867f11242259dd22bb93328681bd6ce3d718d
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.20.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/amauric/tarteaucitron.js
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
25fcf828aaa55306ddc09cfbac9a6f8f126e2d07

Affected versions

Other
20200910
20210305
20210306
20210329
V1.*
V1.2
v0.*
v0.1
v1.*
v1.0
v1.1
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.13.1
v1.14.0
v1.15.0
v1.16.0
v1.16.1
v1.17.0
v1.18.0
v1.18.1
v1.19.0
v1.2
v1.2.0
v1.20.0
v1.3
v1.4
v1.5
v1.6
v1.8
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.9.1
v1.9.3
v1.9.4
v1.9.5
v1.9.6
v1.9.7
v1.9.8
v1.9.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-31138.json"