CVE-2025-31138

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-31138", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-03-26T15:04:52.628Z", "datePublished": "2025-04-07T14:44:40.370Z", "dateUpdated": "2025-04-07T15:49:04.639Z"}, "containers": {"cna": {"title": "tarteaucitron.js allows UI manipulation via unrestricted CSS injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-1021", "lang": "en", "description": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-7524-3396-fqv3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-7524-3396-fqv3"}, {"name": "https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07", "tags": ["x_refsource_MISC"], "url": "https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07"}], "affected": [{"vendor": "AmauriC", "product": "tarteaucitron.js", "versions": [{"version": "< 1.20.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-04-07T14:44:40.370Z"}, "descriptions": [{"lang": "en", "value": "tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allowed an attacker with direct access to the site's source code or a CMS plugin to set values like 100%;height:100%;position:fixed;, potentially covering the entire viewport and facilitating clickjacking attacks. An attacker with high privileges could exploit this vulnerability to overlay malicious UI elements on top of legitimate content, trick users into interacting with hidden elements (clickjacking), or disrupt the intended functionality and accessibility of the website. This vulnerability is fixed in 1.20.1."}], "source": {"advisory": "GHSA-7524-3396-fqv3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-07T15:45:34.187296Z", "id": "CVE-2025-31138", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-07T15:49:04.639Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-31138", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-07T15:45:34.187296Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-07T15:45:52.798Z"}}], "cna": {"title": "tarteaucitron.js allows UI manipulation via unrestricted CSS injection", "source": {"advisory": "GHSA-7524-3396-fqv3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "AmauriC", "product": "tarteaucitron.js", "versions": [{"status": "affected", "version": "< 1.20.1"}]}], "references": [{"url": "https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-7524-3396-fqv3", "name": "https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-7524-3396-fqv3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07", "name": "https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allowed an attacker with direct access to the site's source code or a CMS plugin to set values like 100%;height:100%;position:fixed;, potentially covering the entire viewport and facilitating clickjacking attacks. An attacker with high privileges could exploit this vulnerability to overlay malicious UI elements on top of legitimate content, trick users into interacting with hidden elements (clickjacking), or disrupt the intended functionality and accessibility of the website. This vulnerability is fixed in 1.20.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1021", "description": "CWE-1021: Improper Restriction of Rendered UI Layers or Frames"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-04-07T14:44:40.370Z"}}}, "cveMetadata": {"cveId": "CVE-2025-31138", "state": "PUBLISHED", "dateUpdated": "2025-04-07T15:49:04.639Z", "dateReserved": "2025-03-26T15:04:52.628Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-04-07T14:44:40.370Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "tarteaucitron.js", "vendor": "AmauriC", "versions": [{"status": "affected", "version": "< 1.20.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:amauri:tarteaucitronjs:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "ECAC1B54-E872-41FB-841F-E8590B2A9512", "versionEndExcluding": "1.20.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions (width and height) were not properly validated. This allowed an attacker with direct access to the site's source code or a CMS plugin to set values like 100%;height:100%;position:fixed;, potentially covering the entire viewport and facilitating clickjacking attacks. An attacker with high privileges could exploit this vulnerability to overlay malicious UI elements on top of legitimate content, trick users into interacting with hidden elements (clickjacking), or disrupt the intended functionality and accessibility of the website. This vulnerability is fixed in 1.20.1."}, {"lang": "es", "value": "tarteaucitron.js es un banner de cookies compatible y accesible. Se identific\u00f3 una vulnerabilidad en tarteaucitron.js antes de la versi\u00f3n 1.20.1, donde las entradas controladas por el usuario para las dimensiones de los elementos (ancho y alto) no se validaban correctamente. Esto permit\u00eda a un atacante con acceso directo al c\u00f3digo fuente del sitio o a un complemento de CMS establecer valores como 100%;height:100%;position:fixed;, lo que podr\u00eda cubrir toda la ventana gr\u00e1fica y facilitar ataques de clickjacking. Un atacante con privilegios elevados podr\u00eda explotar esta vulnerabilidad para superponer elementos maliciosos de la interfaz de usuario sobre contenido leg\u00edtimo, enga\u00f1ar a los usuarios para que interact\u00faen con elementos ocultos (clickjacking) o interrumpir la funcionalidad y la accesibilidad previstas del sitio web. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 1.20.1."}], "id": "CVE-2025-31138", "lastModified": "2026-06-17T09:09:55.413", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 3.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-31138", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-07T15:45:34.187296Z", "version": "2.0.3"}}]}, "published": "2025-04-07T15:15:44.047", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-7524-3396-fqv3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1021"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}