tarteaucitron.js allows prototype pollution via custom text injection

Description

tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where the addOrUpdate function, used for applying custom texts, did not properly validate input. This allowed an attacker with direct access to the site's source code or a CMS plugin to manipulate JavaScript object prototypes, leading to potential security risks such as data corruption or unintended code execution. An attacker with high privileges could exploit this vulnerability to modify object prototypes, affecting core JavaScript behavior, cause application crashes or unexpected behavior, or potentially introduce further security vulnerabilities depending on the application's architecture. This vulnerability is fixed in 1.20.1.

Scores

EPSS (exploitation in 30 days)

0.35% · top 71% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Weakness

• CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (opens in a new tab)All about CWE-1321 and its CVEs

Affected products

• AmauriC · tarteaucitron.js

  • affected < 1.20.1

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• npmtarteaucitronjsGHSA-4hwx-xcc5-2hfc (opens in a new tab)

References (2)

• https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-4hwx-xcc5-2hfc (opens in a new tab)x_refsource_CONFIRM
• https://github.com/AmauriC/tarteaucitron.js/commit/74c354c413ee3f82dff97a15a0a43942887c2b5b (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-4hwx-xcc5-2hfc (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-31475](https://trackcve.app/badge/CVE-2025-31475.svg)](https://trackcve.app/cve/CVE-2025-31475)

Record last updated 7 Apr 2025, 15:49 UTC.