Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-31138

CVE-2025-31138:
tarteaucitron.js allows UI manipulation via unrestricted CSS injection

5.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2025-31138
GHSA ID
GHSA-7524-3396-fqv3
EPSS Score
0.08463%
CWE
CWE-1021
Published
4/7/2025
Updated
4/7/2025
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
tarteaucitronjsnpm< 1.20.11.20.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability manifests in all service handlers that construct iframe style attributes using unvalidated width/height parameters. The security patch consistently modifies these locations by adding parseInt validation, indicating they were previously vulnerable to CSS injection. Each service function (e.g., tarteaucitron.services.*) directly processes user-controlled dimension values and injects them into style attributes without sanitization in vulnerable versions, making them primary exploitation points. The high confidence comes from the direct correlation between patch locations and the vulnerability description of CSS injection via dimension parameters.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s i**nti*i** in `t*rt**u*itron.js`, w**r* us*r-*ontroll** inputs *or *l*m*nt *im*nsions (`wi*t*` *n* `**i**t`) w*r* not prop*rly v*li**t**. T*is *llow** *n *tt**k*r wit* *ir**t ****ss to t** sit*'s sour** *o** or * *MS plu*in to s*t

Reasoning

T** vuln*r**ility m*ni**sts in *ll s*rvi** **n*l*rs t**t *onstru*t i*r*m* styl* *ttri*ut*s usin* unv*li**t** wi*t*/**i**t p*r*m*t*rs. T** s**urity p*t** *onsist*ntly mo*i*i*s t**s* lo**tions *y ***in* `p*rs*Int` v*li**tion, in*i**tin* t**y w*r* pr*vi