GHSA-jxj7-g6gm-49j7
Suggest an improvement- Source
- https://github.com/advisories/GHSA-jxj7-g6gm-49j7
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-jxj7-g6gm-49j7/GHSA-jxj7-g6gm-49j7.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-jxj7-g6gm-49j7
- Aliases
- Published
- 2026-07-10T16:05:00Z
- Modified
- 2026-07-10T16:26:41Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies
- Details
-
Summary
tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element that silently deletes a cookie when clicked and trick a user to delete this cookie.
Details
tarteaucitron.cookie.purge()is called on any element with thepurgeBtnclass. It does not check if the element is a legitimate tarteaucitron button or if the cookie corresponds to a service handled by tarteaucitron.PoC
<a class="purgeBtn" data-cookie="foo">Click me!</a>If someone has a cookie with this name and clicks on the link, the cookie is silently deleted.
Impact
The impact is limited because this only works on cookies without HttpOnly=true and the attacker has to know the name of the cookie.
- Database specific
{ "cwe_ids": [ "CWE-285" ], "github_reviewed": true, "github_reviewed_at": "2026-07-10T16:05:00Z", "nvd_published_at": null, "severity": "MODERATE" }- References
Affected packages
npm / tarteaucitronjs
Package
- Name
- tarteaucitronjs
- View open source insights on deps.dev
- Purl
- pkg:npm/tarteaucitronjs