GHSA-P5G4-V748-6FH8
Vulnerability from github – Published: 2025-04-07 16:46 – Updated: 2025-04-07 16:46
VLAI?
Summary
tarteaucitron.js allows url scheme injection via unfiltered inputs
Details
A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert(). Before the fix, URL validation was insufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link.
Impact
An attacker with high privileges could insert a link exploiting an insecure URL scheme, leading to: - Execution of arbitrary JavaScript code - Theft of sensitive data through phishing attacks - Modification of the user interface behavior
Fix https://github.com/AmauriC/tarteaucitron.js/commit/2fa1e01023bce2e4b813200600bb1619d56ceb02
The issue was resolved by enforcing strict URL validation, ensuring that they start with http:// or https:// before being used.
Severity ?
4.8 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "tarteaucitronjs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.20.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-31476"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-07T16:46:57Z",
"nvd_published_at": "2025-04-07T15:15:44Z",
"severity": "MODERATE"
},
"details": "A vulnerability was identified in `tarteaucitron.js`, allowing a user with high privileges (access to the site\u0027s source code or a CMS plugin) to enter a URL containing an insecure scheme such as `javascript:alert()`. Before the fix, URL validation was insufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link.\n\n## Impact\nAn attacker with high privileges could insert a link exploiting an insecure URL scheme, leading to:\n- Execution of arbitrary JavaScript code\n- Theft of sensitive data through phishing attacks\n- Modification of the user interface behavior\n\n## Fix https://github.com/AmauriC/tarteaucitron.js/commit/2fa1e01023bce2e4b813200600bb1619d56ceb02\nThe issue was resolved by enforcing strict URL validation, ensuring that they start with `http://` or `https://` before being used.",
"id": "GHSA-p5g4-v748-6fh8",
"modified": "2025-04-07T16:46:57Z",
"published": "2025-04-07T16:46:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-p5g4-v748-6fh8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31476"
},
{
"type": "WEB",
"url": "https://github.com/AmauriC/tarteaucitron.js/commit/2fa1e01023bce2e4b813200600bb1619d56ceb02"
},
{
"type": "PACKAGE",
"url": "https://github.com/AmauriC/tarteaucitron.js"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "tarteaucitron.js allows url scheme injection via unfiltered inputs"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…