CVE-2025-31476: tarteaucitron.js allows url scheme injection via unfiltered inputs

April 7, 2025

A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access to the site’s source code or a CMS plugin) to enter a URL containing an insecure scheme such as javascript:alert(). Before the fix, URL validation was insufficient, which could allow arbitrary JavaScript execution if a user clicked on a malicious link.

References

github.com/AmauriC/tarteaucitron.js
github.com/AmauriC/tarteaucitron.js/commit/2fa1e01023bce2e4b813200600bb1619d56ceb02
github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-p5g4-v748-6fh8
github.com/advisories/GHSA-p5g4-v748-6fh8
nvd.nist.gov/vuln/detail/CVE-2025-31476

Code Behaviors & Features

Detect and mitigate CVE-2025-31476 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →