The flaw in tarteaucitron.js prior to version 1.33.0 lies in the absence of a validation check in the tarteaucitron.cookie.purge() function when it is invoked on any element bearing the purgeBtn class. An attacker can supply an HTML element decorated with a data‑cookie attribute specifying the name of a non‑HttpOnly cookie that exists in the victim’s browser. When the user clicks that element, the library calls purge() without confirming that the cookie belongs to a legitimate tarteaucitron‑managed service, thereby silently deleting the indicated cookie. The description does not explicitly state that critical cookies such as sessions or tokens could be removed, but it is inferred that if such cookies are non‑HttpOnly a malicious click could terminate a user session or erase preferences stored in that cookie.

Any website that integrates tarteaucitron.js by AmauriC before version 1.33.0 is impacted. All releases lacking the added validation on purgeBtn elements and the strict check of cookie names are vulnerable. Sites using the library for cookie compliance and preference management typically fall into this category unless they have manually removed or modified the purge logic.

With a CVSS score of 4.3 the vulnerability carries a moderate risk. The EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. Attack requires the attacker to host a malicious page containing the crafted element and the victim to click it; the flaw only affects non‑HttpOnly cookies and is not listed in the CISA KEV catalog, suggesting no known public exploitation yet. If a session or authentication cookie is non‑HttpOnly, its removal could abruptly end the user’s session, an impact inferred from the potential effect of deleting arbitrary cookies.