CVE-2026-49977Published
tarteaucitron.js: data-cookie attribute can be used to delete arbitrary cookies
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-49977 · Microsoft / collected KEV context
cve-program · CVE-2026-49977
- https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-jxj7-g6gm-49j7
- https://github.com/AmauriC/tarteaucitron.js/commit/24b5464400ae2ff1ad96a092c629b9d632b9cc93
- https://github.com/AmauriC/tarteaucitron.js/releases/tag/v1.33.0
nvd · CVE-2026-49977
- https://github.com/AmauriC/tarteaucitron.js/commit/24b5464400ae2ff1ad96a092c629b9d632b9cc93
- https://github.com/AmauriC/tarteaucitron.js/releases/tag/v1.33.0
- https://github.com/AmauriC/tarteaucitron.js/security/advisories/GHSA-jxj7-g6gm-49j7
- https://www.drupal.org/sa-contrib-2026-040
osv · GHSA-jxj7-g6gm-49j7
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.