CVE-2026-49977

Name of the Vulnerable Software and Affected Versions tarteaucitron.js versions prior to 1.33.0

Description The software fails to verify if an element is a legitimate button or if the associated cookie belongs to a handled service when calling the tarteaucitron.cookie.purge() function on elements with the purgeBtn class. An attacker capable of injecting HTML with data attributes can create an element using the data-cookie variable to silently delete a non-HttpOnly cookie with a known name when a user clicks it.

Recommendations Update to version 1.33.0.