CVE-2025-31475

CVE-2025-31475 describes a prototype pollution vulnerability in tarteaucitron.js versions prior to 1.20.1, a cookie banner solution. The flaw resides in the addOrUpdate function, which inadequately validates input when applying custom texts. This allows an attacker with high privileges, such as direct source code access or CMS plugin manipulation, to modify JavaScript object prototypes. The vulnerability carries a CVSS score of 6.6 (Medium), indicating that it can be exploited over the network with low attack complexity, requiring high privileges, and potentially leading to low impact on confidentiality, integrity, and availability. Exploitation could result in data corruption, unexpected application behavior, or unintended code execution. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting low public awareness.