The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, a reflected Cross Site Scripting (XSS) vulnerability in the toast notification system allows any attacker to execute arbitrary JavaScript in the context of a victim's browser session by crafting a malicious URL. A series of fix commits on 02 January 2025 fixed this and other vulnerabilities.
The vulnerability consists of improper sanitization of input data in the toast notification system, which classifies it as CWE-79 (Improper Neutralization of Input During Web Page Generation). An attacker prepares a specially crafted malicious URL and induces the victim to open it (user interaction is required). Upon clicking the link, the embedded JavaScript payload is reflected and executed directly in the victim's browser in the context of the vulnerable application.
An attacker can execute arbitrary JavaScript code in the victim's browser session, enabling session data theft, user account takeover, or manipulation of content displayed in the application. The vulnerability has a scope extending beyond the source domain (Scope Changed), which increases its criticality.
Tarkov Data Manager should be updated to a version containing the series of fixes implemented on January 2, 2025. Details regarding specific commits with fixes are available in the vendor references (advisory GHSA-9c23-rrg9-jc89 on GitHub).
Tarkov Data Manager (Tarkov product) — versions released before January 2, 2025
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NTarkov Data Manager
APPTarkov< 2025-01-02