CVE-2026-111713
- Source
- https://cve.org/CVERecord?id=CVE-2026-111713
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111713.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-111713
- Published
- 2026-10-16T17:40:02Z
- Modified
- 2026-10-24T02:50:10Z
- Severity
-
- 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator
- Summary
- tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch
- Details
-
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111713.json" }- References
-
- https://github.com/AmauriC/tarteaucitron.js/releases/tag/v1.37.0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111713.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-111713
- https://www.vulncheck.com/advisories/tarteaucitron-js-before-1.37.0-xss-via-getelemattr-attribute-validation-mismatch
- https://github.com/AmauriC/tarteaucitron.js/commit/068653bd47f5d4a493251ca8e15bd2b0be9b544f
- https://github.com/AmauriC/tarteaucitron.js
- https://github.com/AmauriC/tarteaucitron.js/blob/v1.36.0/tarteaucitron.js#L2641-L2648
- https://github.com/AmauriC/tarteaucitron.js/compare/v1.36.0...v1.37.0
Affected packages
Git / github.com/amauric/tarteaucitron.js
Affected ranges
- Type
- GIT
- Repo
- https://github.com/amauric/tarteaucitron.js
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "1.20.1" }, { "fixed": "1.37.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "068653bd47f5d4a493251ca8e15bd2b0be9b544f" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v1.37.0", "range": [ { "fixed": "636c5f0059efafa5fb5aef1bcdc4c6fdc29730db" } ], "source": "REFERENCES_TAG" } ] }