{"id":"CVE-2025-31476","aliases":["DRUPAL-CONTRIB-2025-027","GHSA-p5g4-v748-6fh8"],"url":"https://o3.security/vulnerability/CVE-2025-31476","summary":"tarteaucitron.js allows url scheme injection via unfiltered inputs","details":"A vulnerability was identified in `tarteaucitron.js`, allowing a user with high privileges (access to the site's source code or a CMS plugin) to enter a URL containing an insecure scheme such as `javascript:alert()`. Before the fix, URL validation was insufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link.\n\n## Impact\nAn attacker with high privileges could insert a link exploiting an insecure URL scheme, leading to:\n- Execution of arbitrary JavaScript code\n- Theft of sensitive data through phishing attacks\n- Modification of the user interface behavior\n\n## Fix https://github.com/AmauriC/tarteaucitron.js/commit/2fa1e01023bce2e4b813200600bb1619d56ceb02\nThe issue was resolved by enforcing strict URL validation, ensuring that they start with `http://` or `https://` before being used.","published":"2025-04-07T14:52:12.728Z","modified":"2026-10-28T02:30:33.010394664Z","cvss":{"score":4.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"},"epss":{"score":0.00354,"percentile":0.29014,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"tarteaucitronjs","fixedVersion":"1.20.1"}],"fix":{"url":"https://github.com/AmauriC/tarteaucitron.js/commit/2fa1e01023bce2e4b813200600bb1619d56ceb02","label":"AmauriC/tarteaucitron.js@2fa1e01"},"references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2025-027"},{"type":"ADVISORY","url":"https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-p5g4-v748-6fh8"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31476.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31476"},{"type":"FIX","url":"https://github.com/AmauriC/tarteaucitron.js/commit/2fa1e01023bce2e4b813200600bb1619d56ceb02"},{"type":"PACKAGE","url":"https://github.com/AmauriC/tarteaucitron.js"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:33.010394664Z"}}