{"id":"CVE-2025-31138","aliases":["GHSA-7524-3396-fqv3"],"url":"https://o3.security/vulnerability/CVE-2025-31138","summary":"tarteaucitron.js allows UI manipulation via unrestricted CSS injection","details":"A vulnerability was identified in `tarteaucitron.js`, where user-controlled inputs for element dimensions (`width` and `height`) were not properly validated. This allowed an attacker with direct access to the site's source code or a CMS plugin to set values like `100%;height:100%;position:fixed;`, potentially covering the entire viewport and facilitating clickjacking attacks.\n\n## Impact\nAn attacker with high privileges could exploit this vulnerability to:\n- Overlay malicious UI elements on top of legitimate content,\n- Trick users into interacting with hidden elements (clickjacking),\n- Disrupt the intended functionality and accessibility of the website.\n\n## Fix https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07\nThe issue was resolved by enforcing strict validation and sanitization of user-provided CSS values to prevent unintended UI manipulation.","published":"2025-04-07T14:44:40.370Z","modified":"2026-08-12T03:51:43.952711550Z","cvss":{"score":5.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"},"epss":{"score":0.00261,"percentile":0.18086,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"tarteaucitronjs","fixedVersion":"1.20.1"}],"fix":{"url":"https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07","label":"AmauriC/tarteaucitron.js@25fcf82"},"references":[{"type":"ADVISORY","url":"https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-7524-3396-fqv3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31138.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31138"},{"type":"FIX","url":"https://github.com/AmauriC/tarteaucitron.js/commit/25fcf828aaa55306ddc09cfbac9a6f8f126e2d07"},{"type":"PACKAGE","url":"https://github.com/AmauriC/tarteaucitron.js"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:43.952711550Z"}}