CVE-2025-48939:
tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript
4.2
CVSS ScoreBasic Information
JavaScriptTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tarteaucitronjs | npm | < 1.22.0 | 1.22.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The security vulnerability is a classic case of DOM Clobbering in tarteaucitron.js. The provided commit 230a3b69d363837acfa895823d841e0608826ba3 clearly shows the vulnerable code and the fix. The vulnerability is not within a specific function but in the script's global scope, which executes when the script is loaded by the browser. The line tarteaucitronPath = (document.currentScript || scripts[scripts.length - 1]).src.split('?')[0] is the source of the issue. It fails to verify the type of document.currentScript before accessing its src property. An attacker can exploit this by creating a DOM element with name="currentScript", which overwrites the legitimate document.currentScript object. The patch addresses this by explicitly checking if document.currentScript is an instance of HTMLScriptElement. Since this code is executed at the top level, a runtime profiler would likely attribute this execution to the global scope, which is why (global scope) is used as the function name.
Vulnerable functions
(global scope)tarteaucitron.js