Medium severity · published Oct 16, 2026
CVE-2026-111713
tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside a benign url to execute script in the site's origin via iframe src.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
tarteaucitron.js · AmauriC
1.20.1 before 1.37.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-111713
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-111713
github.com
https://github.com/AmauriC/tarteaucitron.js/blob/v1.36.0/tarteaucitron.js#L2641-L2648
github.com
https://github.com/AmauriC/tarteaucitron.js/commit/068653bd47f5d4a493251ca8e15bd2b0be9b544f
github.com
https://github.com/AmauriC/tarteaucitron.js/compare/v1.36.0...v1.37.0
github.com
https://github.com/AmauriC/tarteaucitron.js/releases/tag/v1.37.0
www.vulncheck.com
https://www.vulncheck.com/advisories/tarteaucitron-js-before-1.37.0-xss-via-getelemattr-attribute-validation-mismatch
More from tarteaucitron.js
6.6
CVE-2025-31475
tarteaucitron.js allows prototype pollution via custom text injection
6.6
CVE-2025-31138
tarteaucitron.js allows UI manipulation via unrestricted CSS injection
4.8
CVE-2025-31476
tarteaucitron.js allows url scheme injection via unfiltered inputs
4.4
CVE-2026-22809
tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability
4.3
CVE-2026-49977
tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies