tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript

Vulnerability

Overview tarteaucitron.js is a cookie banner library. In versions prior to 1.22.0, the script accessed document.currentScript without verifying it referred to an actual ` element. Due to browser behavior where named DOM elements become properties on document, an attacker could inject an element with name="currentScript"` to clobber the property, causing the script to resolve incorrectly [1][3].

Attack

Vector An attacker who can inject HTML into the page (e.g., via XSS or compromised third-party content) can include a crafted element like `. When tarteaucitron.js runs, document.currentScript points to this element instead of the expected tag. The script then uses the element's src` to determine the CDN URL [3].

Impact

Successful exploitation allows the attacker to alter the CDN domain from which tarteaucitron.js loads its assets. This could lead to serving malicious scripts or resources from an attacker-controlled domain, potentially compromising the site's visitors [3].

Mitigation

The vulnerability is patched in version 1.22.0. The fix checks document.currentScript instanceof HTMLScriptElement and falls back to the last `` tag if the check fails [4]. Users should update to the latest version. No workarounds are documented [1][3].