CVE-2026-111713
Summary
by MITRE • 10/16/2026
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
Xxx Xxxxxxxxxxxxx Xxxxxxxxxx Xx Xxxxxxxxxxxxx.xx Xxxxx Xx Xxxxxxx X.xx.x Xxxxxxxxxx X Xxxxxxxxxxx Xxxxx-xxxx Xxxxxxxxx Xxxx Xxxxxxxx Xxxx Xx Xxxxxxxxxxxxx Xx Xxxxxxxxx Xxxxxxxxxx Xxxxx Xxxxxx Xxx Xxxxxxx'x Xxx Xxxxxxxxxxxx Xxxxxxxx. Xxxxxxxxxxxx, Xxx Xxxxxxxx Xxxxxxxxxxx Xxx Xxxxxxxxxx Xxxxxxx Xxxxxxxxxx, Xxxxx Xx Xxxxxxxxxxx, Xxxxxxxxx Xxxx-xxxxxxxx Xxxxxxxxxx Xxxxxxx Xxxxxxxx Xxx Xxxx Xxxxxxxx Xxxxxxxxxxx Xxxx Xxx Xxxxxxxx Xx Xxxxxxxx Xxxxx Xxxx Xx Xxx Xxxxxxxxxx. Xxxx Xxxxxxxxxxxxx Xxxxxxxxx Xxxxxxx X Xxxxxxxxxx Xxxxxxx Xxx Xxxxxx Xxxx Xxx Xxxxxxxxx Xxxxxxxxxx Xxxx Xxx Xxxxxxx Xxxxxx Xxx Xxxxxxx Xxxxxxx. Xxx Xxxxxxx Xxxxxxxxxx Xx Xxxxx-xxxx Xxxxx Xx Xxxxxx Xxxx Xxxxxxxx Xxxxxxxxx Xxxxxx Xxx Xxxxxx Xxxxxxx Xxxxxx Xx Xxxxxx Xxxxxxxxx Xxxxxxxxx, Xxxxxxx Xxxxxxxxxx Xxxxx Xxxxxxx Xxxxxx Xxx Xxxxxxxxx Xxx-xx-xxx-xxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxx Xx Xxxxxxx. Xxxxxxx, Xxxx Xxxxxxxx Xxxxx Xx Xxxxxxx Xxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxx Xx Xxx Xx Xxx, Xxxxx Xx Xxxxx Xx Xxxxxx Xxx Xxxxxxxx Xx Xxxxxxxxxx Xxxxxxxx Xxxx Xxxx-, Xxxxx Xxx Xxxxxxxx Xxxx Xx Xxx Xxxxxxx Xxx Xxxxxxxxxxxxx Xxxxxxxx Xxxx Xxxxxxxx Xxxxxx Xxxxxxx Xxxxx Xx Xxxxxxxx Xxxxxxx Xxxxxxxxx.
Xxxx Xxxxxxxxx Xxxx Xxxxxx Xx Xxxxxxxx Xxx Xxxxxxxxx Xxx Xxxxxxx Xx Xxxxxx Xxxxxx Xxxx X Xxxxxxx Xxxxxxxxx Xxxx Xxxxxxx Xx Xxxxxx Xxx Xxxxx-xxxx Xxxxxxxxxxx Xxxxxxxx. Xx Xxxxxxxx X Xxxxxxxxx Xxxxxxx Xxxx Xxxxxxxx Xxxx X Xxxxxx Xxx Xxxxxxxxx, Xxxx Xx Xxx Xxxxxxxx Xx X Xxxxxxxxxx Xxxxx Xxxx, Xxx X Xxxx-xxx Xxxxxxxxx Xxxxxxxxxx X Xxxxxxxxxx: Xxx Xxxxxx, Xxx Xxxxxxxx Xxx Xxxxxxx Xxx Xxxxxxx Xxxxx Xx Xxxxxxxxxxx. Xxx Xxxxxxxx Xx Xxx Xxxxx Xxxxx Xxx Xxxxxxxxx Xxx Xxxxxxx Xxxxxxxxxx Xxxxx Xxxxxxxxx Xx Xxx Xxxxxxx'x Xxxxxxxx Xxxxx, Xxxxxxx Xx Xx Xxxxxxx Xxxx Xxxxxxxxx Xx Xxxxxxxxxx Xxx Xxxxxxx. Xxxxxxxxxxxx, Xxxx Xxx Xxxxxx Xxxxxxxx Xx Xxxxxxx Xxx Xxxx-xxx Xxxxx Xxx Xxx Xxxxxxxx Xxxxxxx, Xxxx Xx Xxxxxxx Xx Xxxxxx Xxxxxx, Xx Xxxxxxxxxxxxx Xxxxxxxx Xxx Xxxxxxxxxx: Xxx Xxxxxxxxx Xxxxxx Xxxx Xxxxxxxxx. Xxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxx Xxxxxxxxx Xxxxxx Xxx Xxxxxxx Xx Xxx Xxxxxx Xxxx'x Xxxxxx, Xxxxxxxxxxx Xxxxxxxxxxxx Xxx Xxxxxxxx Xxxxxxxx Xxxxxxxxxxx Xx Xxx Xxxxx-xxxx Xxxxxx.
Xxx Xxxxxxxxxxx Xxxxxx Xx Xxxx Xxxxxxxxxxxxx Xx Xxxxxx, Xxxxxxxxxxxx Xx Xxxxxxxxxxxx Xxxxx Xxxxxxx Xxxxxxxx Xx Xxxxxx Xxxxxxxxx Xx Xxxxxxxxx Xxx Xxxxx Xxxx Xxxxxxx Xxxxxx Xx Xxxxx, Xxxx Xx Xxx Xxxxxxx Xx Xxxxxxxxx Xxxxx Xxxxxxxxxxxx. Xxxxxxxxxx Xxxxxxxxxxxx Xxxxxxx Xx Xxxxxxxx Xx Xxxxxxx Xxxxxxx Xx Xxxxxx Xx Xxxxxxxxxxxxx Xxxxx, Xxxxx Xxxxxxx Xxxxxxx Xxx Xxxxxxxxxxxxxx Xxxxxx, Xxxxxx Xxx Xxxxxxx, Xx Xxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxx Xxxxx. Xxxxxxx Xxx Xxxxxxxxx Xxxxxx Xxxxxx Xxx Xxxx'x Xxxxxx, Xxxxxxxx Xxxx-xxxxxx Xxxxxx Xxxxxxxxxxx Xx Xxx Xxxxxxx Xxx Xxxxxx Xxxx Xxxxxxxxx Xxxxx Xxxxxxx, Xxxxxx Xxxxxxxx Xx Xxxxxxxx Xxxx, Xx Xxxxxxxxxxxx Xxx Xxx Xx Xxxx Xxxx Xxx Xxxx Xx Xxxxxxx Xxxxxxxxxxx Xx Xxxx Xxxx Xx Xxxxxx Xxxxxxxxx. Xxxx Xxxx Xx Xxxxxx Xx Xxxxxxxxxxxx Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxx Xxxxxxxxxxxxx Xxxxxxxxxx Xx Xxx Xxxxxxx Xxxxxxx Xxxxxx, Xxxxxx Xxxxxxxxx Xx Xxxxxxxxx Xxxxxxxx Xxxxxxxx Xxxxxxxxxxx Xxxxxxxxx Xx Xxxx Xx Xxx Xxxxxxx Xxx Xxxx Xxxxxxxx Xxxxxxxxx Xxxxxxx Xxxxxxxx.
Xxxx X Xxxxxxxxxxxxxx Xxxxxxxxxxx, Xxxx Xxxxxxxxxxxxx Xxxxxx Xxxx Xxx-xx, Xxxxx Xxxxxxxxx Xxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxx Xxxxxx Xxx Xxxx Xxxxxxxxxx Xxxxxxxx Xxxxx Xx Xxxxx-xxxx Xxxxxxxxx (xxx). Xxx Xxxx Xxxxx Xx Xxxxxxxxxxx Xxxxx Xxx-xxx, Xxx Xxxxxxxxxxx Xx Xxxxxxxxx Xxxx, Xxxxxxxx Xxx Xxxxxxxx Xxxxxxxxx Xxxxxxxx Xxxxxxxxx Xxxxx Xxxxxxxxxx Xxxxxxx Xxxxxxxxx Xxxxxx Xxxxxxxxxxxx. Xx Xxxxx Xx Xxxxxxxxx Xxxxxxx, Xxxx Xxxxxxx Xxxx Xxxxxxxx Xx Xxxxx Xxx&xx Xxxxxxxxx Xxxxx, Xxxxxxx Xxx Xxxxxxxxx Xxxxxxxxxxx, Xxxxxxxxxxxx Xxxxxx Xxx Xxxxxxx Xx Xxxxxx-xxxx Xxxxxxxxx Xxx Xxxxxxxxxx. Xxx Xxxxxx Xxxxxx Xx Xxxxxxxxxx Xx Xx Xxxxxxxxx Xxxx Xxxxx Xxxxxxxxx Xxxx Xxxxxxxxxx Xxxxxxx Xxxx Xx Xxxxxxxxx Xxxx Xxxxxxx Xxxxxx Xxxxxxxxxxxx.
Xx Xxxxxxxx Xxxx Xxxxxxxxxxxxx, Xxxxxxxxxxxxx Xxxx Xxxxxxx Xxxxxxxxxxxxx.xx Xx Xxxxxxx X.xx.x Xx Xxxxx, Xxxxx Xxxxxxxxx Xxx Xxxxxxxxxxxxx Xx Xxxxxxxxx Xxxxxxxxxx Xx Xxxxxxxxx Xxx Xxxxx-xxxx Xxxxx Xx Xxxxx Xxxx-xxxxxxxx Xxxxxxxxxx Xx Xxxx. Xxx Xxxxxxxxxxxx Xxxxx Xx Xxxxxxxxx Xxxxxxx Xx Xxx Xxxxxxxx, X Xxxxxxxxx Xxxxxxxxxx Xxxxxxxx Xxxxxxxxxxxx Xxxxxx Xxxxxxx Xxxxxxxx Xxxxxx Xxxxxxx Xxxx Xxxxxxxx Xxxxxx Xxxxxxxxx Xxx Xxxxxx Xxxxxxx Xx Xxxxxxx Xxxxxxx Xxxx. Xxxxxxxxxxxx, Xxxxx Xxxxxxxxxxxx Xxxxxx Xx Xxxxxxxx Xx Xxx Xxxxxxxxxxx Xxxxx Xxx Xxx Xxxx-xxxxxxxxx Xxxxxxx Xxxx Xxx Xxxxxxxx Xxxx Xxxx Xxxxxxx, Xxxxxxxx Xxxx Xx Xxxxxxxxxx: Xxxx Xxx Xx Xxxxxxxx Xxxx Xxxx Xxxxxxxxxx Xx Xxxxx Xxx Xxxxxxxxxx. Xxxxxxx Xxxxxxxx Xxxxxx Xx Xxxxx-xxxxx Xxxxxxxxxx Xxxxxxxxx Xxx Xxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxx Xxxxx Xxxxxx Xxxx Xxx Xx Xxxxxxxxx Xx Xxxxxxxxxx Xxxxxxxxxxxx.