tarteaucitronjs-1.26.0.tgz: 1 vulnerabilities (highest severity is: 4.4) #227
Description
Vulnerable Library - tarteaucitronjs-1.26.0.tgz
tarteaucitron.io - Get a compliant and accessible cookie banner
Library home page: https://registry.npmjs.org/tarteaucitronjs/-/tarteaucitronjs-1.26.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Dependency | Type | Fixed in (tarteaucitronjs version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2026-22809 |  Medium |
4.4 | tarteaucitronjs-1.26.0.tgz | Direct | https://github.com/AmauriC/tarteaucitron.js.git - v1.29.0 | ❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-22809
Vulnerable Library - tarteaucitronjs-1.26.0.tgz
tarteaucitron.io - Get a compliant and accessible cookie banner
Library home page: https://registry.npmjs.org/tarteaucitronjs/-/tarteaucitronjs-1.26.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
- ❌ tarteaucitronjs-1.26.0.tgz (Vulnerable Library)
Found in base branch: develop
Vulnerability Details
tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (ReDoS) vulnerability was identified in tarteaucitron.js in the handling of the issuu_id parameter. This vulnerability is fixed in 1.29.0.
Publish Date: 2026-01-13
URL: CVE-2026-22809
CVSS 3 Score Details (4.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2026-01-13
Fix Resolution: https://github.com/AmauriC/tarteaucitron.js.git - v1.29.0
Step up your Open Source Security Game with Mend here