npm tarteaucitronjs

Name: npm tarteaucitronjs
Brand: npm

productUS

pkg:npm/tarteaucitronjs

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

public exploit

EPSS ≥ 10%

unpatched

critical

by severity

0critical0high3medium0low

updated 2026-10-28

vulnerabilities (8)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2023-3620US	medium5.4	0.54% (45th)	—	1.13.1	2023-07-11	< 1.13.1
CVE-2025-31476US	—	0.36% (30th)	—	1.20.1	2025-04-07	< 1.20.1
CVE-2026-49977US	—	0.35% (29th)	—	1.33.0	2026-07-17	< 1.33.0
CVE-2025-31475US	medium6.6	0.35% (29th)	—	1.20.1	2025-04-07	< 1.20.1
CVE-2025-1467US	—	0.32% (25th)	—	1.17.0	2025-02-23	< 1.17.0
CVE-2025-31138US	medium6.6	0.27% (18th)	—	1.20.1	2025-04-07	< 1.20.1
CVE-2025-48939US	—	0.20% (10th)	—	1.22.0	2025-07-03	< 1.22.0
CVE-2026-22809US	—	0.13% (2nd)	—	1.29.0	2026-01-13	< 1.29.0

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3 CVEs
CWE-1021Improper Restriction of Rendered UI Layers or Frames1 CVEs
CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')1 CVEs
CWE-1333Inefficient Regular Expression Complexity1 CVEs
CWE-138Improper Neutralization of Special Elements1 CVEs
CWE-285Improper Authorization1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.