Most recent entries from all

EUVD-2026-339038

fkie_cve-2026-49977

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by tarteaucitron. If an attacker can write HTML with data attributes, an element with data-cookie can silently delete a non-HttpOnly cookie with a known name when clicked by a user. This issue is fixed in version 1.33.0.

GHSA-jxj7-g6gm-49j7 — tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies

Affected: npm: tarteaucitronjs

### Summary

tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element that silently deletes a cookie when clicked and trick a user to delete this cookie.

### Details

`tarteaucitron.cookie.purge()` is called on any element with the `purgeBtn` class. It does not check if the element is a legitimate tarteaucitron button or if the cookie corresponds to a service handled by tarteaucitron.

### PoC

```html <a class="purgeBtn" data-cookie="foo">Click me!</a> ```

If someone has a cookie with this name and clicks on the link, the cookie is silently deleted.

### Impact

The impact is limited because this only works on cookies without HttpOnly=true and the attacker has to know the name of the cookie.

WID-SEC-W-2026-1799 — Drupal Erweiterungen: Mehrere Schwachstellen

Ein entfernter Angreifer kann mehrere Schwachstellen in verschiedenen Drupal Erweiterungen ausnutzen, um Daten zu manipulieren oder offenzulegen, sowie um Cross-Site Scripting Angriffe durchzuführen.