Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-31476

CVE-2025-31476:
tarteaucitron.js allows url scheme injection via unfiltered inputs

4.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2025-31476
GHSA ID
GHSA-p5g4-v748-6fh8
EPSS Score
0.11887%
CWE
CWE-79
Published
4/7/2025
Updated
4/7/2025
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
tarteaucitronjsnpm< 1.20.11.20.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The security patch modifies the getElemAttr function to add validation for URL attributes and restrict srcdoc handling. This indicates:

  1. The function was responsible for processing element attributes including URLs
  2. Pre-patch versions lacked proper scheme validation (allowed javascript:)
  3. The function's output was used in contexts where unvalidated URLs could trigger XSS
  4. The vulnerability manifests when this function processes malicious 'url' or 'srcdoc' attributes, which would appear in stack traces during exploitation

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s i**nti*i** in `t*rt**u*itron.js`, *llowin* * us*r wit* *i** privil***s (****ss to t** sit*'s sour** *o** or * *MS plu*in) to *nt*r * URL *ont*inin* *n ins**ur* s***m* su** *s `j*v*s*ript:*l*rt()`. ***or* t** *ix, URL v*li**tion w*

Reasoning

T** s**urity p*t** mo*i*i*s t** **t*l*m*ttr *un*tion to *** v*li**tion *or URL *ttri*ut*s *n* r*stri*t sr**o* **n*lin*. T*is in*i**t*s: *. T** *un*tion w*s r*sponsi*l* *or pro**ssin* *l*m*nt *ttri*ut*s in*lu*in* URLs *. Pr*-p*t** v*rsions l**k** pro