| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/tacjs | < 6.5.0 | 6.5.0 |
| tacjs | ≥ 8.x-1.0, < 8.x-6.5 | 8.x-6.5 |
This module enables sites to comply with the European cookie law using tarteaucitron.js.
The module doesn't sufficiently filter user-supplied markup inside of content leading to a persistent Cross Site Scripting (XSS) vulnerability. More details are available in CVE-2023-3620.
This vulnerability is mitigated by the fact that an attacker needs to be able to write content in the page, a feature commonly available on Drupal sites.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free