GHSA-q43x-79jr-cq98

Source

https://github.com/advisories/GHSA-q43x-79jr-cq98

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-q43x-79jr-cq98/GHSA-q43x-79jr-cq98.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-q43x-79jr-cq98

Aliases

CVE-2025-48939

Published

2025-07-03T16:59:09Z

Modified

2025-07-03T18:50:09Z

Severity

4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L CVSS Calculator

Summary

tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

Details

A vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element such as:

<img name="currentScript" src="https://malicious.example.com">

it could clobber the document.currentScript property. This causes the script to resolve incorrectly to an element instead of the

Database specific

{
    "cwe_ids":  [
        "CWE-138"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-07-03T16:59:09Z",
    "nvd_published_at":  "2025-07-03T17:15:39Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / tarteaucitronjs

Package

Name: tarteaucitronjs; View open source insights on deps.dev
Purl: pkg:npm/tarteaucitronjs

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.22.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-q43x-79jr-cq98/GHSA-q43x-79jr-cq98.json"