CVE-2026-49977 — tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies
tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check w…
Published: 2026-07-17 · CVSS: 4.3 · CVSS 3.1
tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.33.0, tarteaucitron.cookie.purge() is called on any element with the purgeBtn class and does not check whether the element is a legitimate tarteaucitron button or whether the cookie corresponds to a service handled by tarteaucitron. If an attacker can write HTML with data attributes, an element with data-cookie can silently delete a non-HttpOnly cookie with a known name when clicked by a user. This issue is fixed in version 1.33.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7