Vulnerability Description
tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by tarteaucitron. If an attacker can write HTML with data attributes, an element with data-cookie can silently delete a non-HttpOnly cookie with a known name when clicked by a user. This issue is fixed in version 1.33.0.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/AmauriC/tarteaucitron.js/commit/24b5464400ae2ff1ad96a092c629b
- https://github.com/AmauriC/tarteaucitron.js/releases/tag/v1.33.0
- https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-jxj7-g6gm-4
- https://www.drupal.org/sa-contrib-2026-040
FAQ
What is CVE-2026-49977?
CVE-2026-49977 is a vulnerability with a CVSS score of 4.3 (MEDIUM). tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a...
How severe is CVE-2026-49977?
CVE-2026-49977 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-49977?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.