tarteaucitron.js vulnerable to Cross-site Scripting

中危 5.4CVE-2023-3620 · GHSA-f44m-65h3-99vc · Published 11/07/2023 · updated 17/06/2026

要点

CVE-2023-3620 是影响 tarteaucitron (tarteaucitron), tarteaucitronjs 的中危 (CVSS 5.4)漏洞。
未来 30 天内被利用的概率（EPSS）：0.54%，高于 45.7% 的漏洞。
修复：升级到 1.13.1 或更高版本。

Package	Affected versions	Patched versions
tarteaucitron tarteaucitron	`< 1.13.1`	`1.13.1`
tarteaucitronjs npm	`< 1.13.1`	`1.13.1`

Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.

NVD description

Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.