tarteaucitron.js DOM Clobbering Vulnerability via document.currentScript Access

A vulnerability exists in tarteaucitron.js cookie banner versions prior to 1.22.0, where the library improperly accesses document.currentScript without confirming it points to a valid <script> element. This flaw allows an attacker to inject an HTML element that overwrites the currentScript property, causing the script to misinterpret the source and potentially disrupt functionality. In certain browser environments, named DOM elements can become global document properties, creating an opportunity for exploitation. An attacker could manipulate the CDN domain from which tarteaucitron is loaded.

Impact

Exploitation could lead to unauthorized changes in the CDN source of tarteaucitron.js, potentially allowing for the injection of malicious scripts.

Remediation

Users can upgrade to tarteaucitron.js version 1.22.0 or later to address this vulnerability.