Skip to content
Fencer Intel
medium 4.2

CVE-2025-48939 json

tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

published last yr. modified 4mo ago also EUVD-2025-19885 , GHSA-q43x-79jr-cq98

cvss
4.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element, it could clobber the document.currentScript property. This causes the script to resolve incorrectly to an element instead of the <script> tag, leading to unexpected behavior or failure to load the script path correctly. This issue arises because in some browser environments, named DOM elements become properties on the global document object. An attacker with control over the HTML could exploit this to change the CDN domain of tarteaucitron. This issue has been patched in version 1.22.0.

Patch / fix

  • npm tarteaucitronjs 1.22.0
  • amauri tarteaucitronjs 1.22.0
  • tarteaucitron tarteaucitron 1.22.0

Is CVE-2025-48939 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
last yr.

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-q43x-79jr-cq98 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L
GitHub 3.1 4.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L

Affected packages

ecosystem package affected fixed in
npm tarteaucitronjs
<1.22.0
1.22.0

Affected products

  • AmauriC tarteaucitron.js

Classification

Weakness
  • CWE-138 Improper Neutralization of Special Elements

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.