CVE-2026-49977: tarteaucitron.js XSS Vulnerability

CVE-2026-49977 Overview

CVE-2026-49977 is an improper authorization vulnerability [CWE-285] in tarteaucitron.js, a widely deployed cookie consent banner used on websites and integrated into platforms such as Drupal. Versions prior to 1.33.0 invoke tarteaucitron.cookie.purge() on any DOM element carrying the purgeBtn class without validating that the element belongs to tarteaucitron or that the referenced cookie corresponds to a service managed by the library. An attacker who can inject HTML with arbitrary data-* attributes into a page can craft an element that silently deletes any non-HttpOnly cookie with a known name when a user clicks it. The issue is fixed in version 1.33.0.

Critical Impact
User-triggered deletion of non-HttpOnly cookies with attacker-chosen names, enabling forced logout, session disruption, or removal of security-relevant client-side state.

Affected Products

tarteaucitron.js versions prior to 1.33.0
Drupal sites using the tarteaucitron.js contrib module (see Drupal Security Advisory SA-2026-040)
Any web application embedding vulnerable tarteaucitron.js releases

Discovery Timeline

2026-07-17 - CVE-2026-49977 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-49977

Vulnerability Analysis

The flaw resides in the client-side purge logic. tarteaucitron.cookie.purge() iterates over an array of cookie names and deletes each matching cookie by setting an expired value. The purgeBtn click handler passes cookie names read from a DOM element's data-cookie attribute directly into purge(), without verifying that the element was rendered by tarteaucitron or that the cookie name belongs to a service currently declared in tarteaucitron.services and active in tarteaucitron.job.

As a result, any element bearing the purgeBtn class and a data-cookie attribute becomes a functional cookie-deletion trigger. Deletion is limited to cookies accessible from JavaScript, so HttpOnly cookies remain protected. Session cookies, CSRF tokens, preference cookies, and analytics identifiers that are not HttpOnly are exposed.

Root Cause

The root cause is missing authorization [CWE-285] on a privileged client-side action. The purge routine trusts DOM-supplied input and does not cross-check the target cookie against the set of cookies owned by active services. Any HTML injection sink on the same origin — a stored comment field, an unsanitized profile attribute, or a permissive rich-text editor — becomes sufficient to weaponize the handler.

Attack Vector

Exploitation requires the attacker to place HTML with specific attributes into a page rendered on the target origin, then rely on a user click. A minimal payload uses the purgeBtn class and a data-cookie value naming the victim cookie. When a visitor clicks the element, the vulnerable handler deletes the named cookie from the browser, potentially logging the user out or invalidating security tokens.

javascript

// Patch excerpt: only delete cookie if owned by an active service
"purge": function (arr) {
    "use strict";

    var i,
        j,
        k,
        service,
        allowed,
        rgxpCookie;

    for (i = 0; i < arr.length; i += 1) {

        allowed = false;

        if (tarteaucitron.parameters.cookieslist !== true && tarteaucitron.parameters.cookieslistEmbed !== true) {

            for (j = 0; j < tarteaucitron.job.length; j += 1) {

                service = tarteaucitron.services[tarteaucitron.job[j]];

                if (service !== undefined && service.cookies !== undefined) {

                    for (k = 0; k < service.cookies.length; k += 1) {

                        if (service.cookies[k] === arr[i]) {
                            allowed = true;
                            break;

Source: GitHub Commit 24b5464. The fix introduces an allowed gate that only permits deletion when the target cookie name matches a cookie declared by an active service in tarteaucitron.job.

Detection Methods for CVE-2026-49977

Indicators of Compromise

Unexpected DOM elements containing both the purgeBtn CSS class and a data-cookie attribute in user-generated content or CMS-authored pages
Client-side telemetry showing session or authentication cookies being cleared without a corresponding logout or consent-withdrawal event
Support tickets reporting sudden logouts or lost preferences correlated with visits to pages containing untrusted HTML

Detection Strategies

Scan repositories, database content fields, and cached HTML for occurrences of class="purgeBtn" or data-cookie= outside the tarteaucitron consent banner template
Inventory the deployed tarteaucitron.js version across web properties and flag any release earlier than 1.33.0
Review Content Security Policy (CSP) reports for inline event handlers or injected markup on pages that render user-supplied content

Monitoring Recommendations

Instrument web analytics or RUM to record abrupt drops in authenticated session cookies immediately after page interaction
Monitor WAF and application logs for HTML injection patterns that include purgeBtn, data-cookie, or data-cookies attributes
Alert on modifications to CMS content that introduce class attributes matching tarteaucitron control classes

How to Mitigate CVE-2026-49977

Immediate Actions Required

Upgrade tarteaucitron.js to version 1.33.0 or later on every site that embeds the library
Drupal operators should apply the update referenced in Drupal Security Advisory SA-2026-040
Audit user-generated content and CMS templates for injected elements using the purgeBtn class or data-cookie attribute and remove them
Mark session and authentication cookies as HttpOnly and Secure where feasible so they cannot be deleted via client-side script

Patch Information

The fix is delivered in tarteaucitron.js Release v1.33.0. The patch, tracked in GHSA-jxj7-g6gm-49j7, modifies tarteaucitron.cookie.purge() to verify that each cookie name passed for deletion is declared by a service present in tarteaucitron.job before removing it.

Workarounds

Enforce a strict Content Security Policy that blocks inline event handlers and restricts where third-party markup can render
Sanitize HTML on input and output to strip class and data-* attributes from untrusted user content
Rotate cookie names for critical client-side state so attacker guesses of well-known names are less effective as a temporary measure

bash

# Verify installed version and update via npm
npm ls tarteaucitron.js
npm install tarteaucitron.js@^1.33.0

# For Drupal deployments using Composer
composer update drupal/tarteaucitronjs
drush cache:rebuild