Live › vulnerability › CVE-2026-111713
Go to dashboardtarteaucitron.js before 1.37.0 checks the https-only rule on a plain attribute but reads the data-prefixed one, so a javascript: URL slips through. An attacker who can place markup on the page, such as a CMS author, can run script in the site's origin via an iframe src.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites that load tarteaucitron.js below 1.37.0 and let someone other than trusted developers place markup on those pages, such as CMS authors or user-generated content. Sites that only serve static code controlled by the team, or that do not use the library, can skip it.
No product ranges from the sources yet.
tarteaucitron.js in the site's package.json or loaded script tags and read its version; anything below 1.37.0 is exposeddata-url attributes into pages that load the library1.37.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.
This page as .md · .json · in your agent: get_signal("CVE-2026-111713")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.