PT-2025-27811 · Unknown · Tarteaucitron.Js

Published 2025-07-03 · Updated 2025-07-03 · CVE-2025-48939

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions: tarteaucitron.js versions prior to 1.22.0

Description: A vulnerability was identified in tarteaucitron.js where document.currentScript was accessed without verifying that it referenced an actual <script> element. If an attacker injected an HTML element, it could clobber the document.currentScript property, leading to unexpected behavior or failure to load the script path correctly. This issue arises because in some browser environments, named DOM elements become properties on the global document object. An attacker with control over the HTML could exploit this to change the CDN domain of tarteaucitron.

Recommendations: For versions prior to 1.22.0, update to version 1.22.0 to resolve the issue. As a temporary workaround, consider restricting access to the HTML elements that could be used to exploit this vulnerability, until the update can be applied.

Exploit

Fix

Weakness Enumeration

CWE-138

Related Identifiers

CVE-2025-48939

GHSA-Q43X-79JR-CQ98

Affected Products

Tarteaucitron.Js

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48939.json · Exploit
• https://github.com/AmauriC/tarteaucitron.js/commit/230a3b69d363837acfa895823d841e0608826ba3 · Patch
• https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-q43x-79jr-cq98 · Patch
• https://osv.dev/vulnerability/GHSA-q43x-79jr-cq98 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48939 · Security Note
• https://github.com/AmauriC/tarteaucitron.js · Note
• https://twitter.com/CVEnew/status/1940815285407088790 · Twitter Post