Tarteaucitron.js versions before 1.37.0 contain a cross‑site scripting flaw caused by a mismatch between getElemAttr's resolution of data-prefixed attributes and the library’s https‑only guard that validates unprefixed attributes. This discrepancy allows an attacker who can inject HTML markup, such as a CMS author, to add a data‑url attribute with a javascript: URL adjacent to a normal URL. When the library processes the attributes, the javascript is executed in the site’s origin context via an iframe source. The result is a classic XSS that can run arbitrary script on behalf of the user visiting the affected page.

Any deployment of the tarteaucitron.js library older than version 1.37.0 is vulnerable. The affected product, maintained by AmauriC, is listed in the Common Platform Enumeration as amauri:tarteaucitronjs and is used on sites that include the library for cookie banner management.

The CVSS score of 5.1 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no large‑scale exploitation has been observed. Attacks require the ability to insert markup into the page – for example, a site administrator or CMS user – after which the malicious data‑url is processed by the library. The exploit path is therefore conditional on content injection privileges but can deliver code that runs with the site’s origin.