Detections
Analytics
SCA: security update for tarteaucitronjs (GHSA-p5g4-v748-6fh8)
medium Tenable Cloud Security Plugin ID 424776
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in
tarteaucitron.js, allowing a user with high privileges (access to the site's source code or a CMS plugin)
to enter a URL containing an insecure scheme such as javascript:alert(). Before the fix, URL validation
was insufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link.
An attacker with high privileges could insert a link exploiting an insecure URL scheme, leading to
execution of arbitrary JavaScript code, theft of sensitive data through phishing attacks, or modification
of the user interface behavior. This vulnerability is fixed in 1.20.1. (CVE-2025-31476)
See Also
Plugin Details
Severity: Medium
ID: 424776
Version: Revision 1.15
Type: Local
Family: SCA Checks
Published: 4/7/2025
Updated: 6/1/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3.0
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 4.7
Temporal Score: 3.5
Vector: CVSS2#AV:N/AC:L/Au:M/C:P/I:P/A:N
CVSS Score Source: CVE-2025-31476
CVSS v3
Risk Factor: Medium
Base Score: 4.8
Temporal Score: 4.2
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 4/7/2025
Vulnerability Publication Date: 4/7/2025
Reference Information
CVE: CVE-2025-31476
cwe: CWE-79