AmauriC tarteaucitron.js up to 1.20.0 ui layer

Summaryinfo

A vulnerability described as problematic has been identified in AmauriC tarteaucitron.js up to 1.20.0. The impacted element is an unknown function. Such manipulation leads to ui layer. This vulnerability is listed as CVE-2025-31138. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in AmauriC tarteaucitron.js up to 1.20.0 and classified as problematic. Affected by this issue is an unknown code block. The manipulation with an unknown input leads to a ui layer vulnerability. Using CWE to declare the problem leads to CWE-1021. The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. Impacted is integrity. CVE summarizes:

tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allowed an attacker with direct access to the site's source code or a CMS plugin to set values like 100%;height:100%;position:fixed;, potentially covering the entire viewport and facilitating clickjacking attacks. An attacker with high privileges could exploit this vulnerability to overlay malicious UI elements on top of legitimate content, trick users into interacting with hidden elements (clickjacking), or disrupt the intended functionality and accessibility of the website. This vulnerability is fixed in 1.20.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-31138 since 03/26/2025. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are necessary for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.20.1 eliminates this vulnerability. Applying the patch 25fcf828aaa55306ddc09cfbac9a6f8f126e2d07 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• JavaScript Library

Vendor

• AmauriC

Name

• tarteaucitron.js

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20.0

License

• open-source

Website

• Product: https://github.com/AmauriC/tarteaucitron.js/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion