CVE-2026-26862: CleverTap Web SDK Vulnerable to DOM-based XSS via window.postMessage
Summary
CVE-2026-26862: CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage. Affects clevertap-web-sdk versions < 1.15.3. Fixed in 1.15.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CleverTap Web SDK is a JavaScript library that enables developers to integrate CleverTap's customer engagement and analytics features into their web applications. The SDK provides functionalities such as user segmentation, push notifications, and in-app messaging. However, versions 1.15.2 and earlier are susceptible to a DOM-based Cross-Site Scripting (XSS) vulnerability, which can be exploited through improper origin validation in the Visual Builder module.
Vulnerability Detail
The vulnerability arises from the use of the includes() method in the origin validation process within the src/modules/visualBuilder/pageBuilder.js file. This method checks if the originUrl contains 'dashboard.clevertap.com', but an attacker can bypass this check by crafting a malicious subdomain. As a result, an attacker could execute arbitrary JavaScript code in the context of the user's browser, potentially leading to data theft, session hijacking, or other malicious actions.
How To Fix
Minimum fixed version
1.15.3
This is the first release that contains the fix.
npm install clevertap-web-sdk@1.15.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks on the origin of messages received via window.postMessage to ensure they are from trusted sources. For example, you can modify your message handling code as follows:
window.addEventListener('message', function(event) {
const allowedOrigins = ['https://dashboard.clevertap.com'];
if (allowedOrigins.includes(event.origin)) {
// Handle the message
} else {
console.warn('Blocked message from untrusted origin:', event.origin);
}
});
Conclusion
The CleverTap Web SDK has a significant vulnerability (CVE-2026-26862) that allows for DOM-based XSS attacks due to improper origin validation. It is crucial for developers using versions 1.15.2 and earlier to update to version 1.15.3 or later to mitigate this risk. Implementing additional origin checks can serve as a temporary workaround.
See every vulnerability recorded for clevertap-web-sdk →
FAQ
The CleverTap Web SDK is a JavaScript library that allows developers to integrate CleverTap's customer engagement and analytics features into their web applications.
DOM-based XSS is a type of vulnerability where an attacker can inject malicious scripts into a web application by manipulating the Document Object Model (DOM) in the user's browser.
If exploited, this vulnerability can allow attackers to execute arbitrary JavaScript code in the context of your application, leading to potential data theft, session hijacking, or other malicious actions.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can use the Vulert playground without signup to test your application.
The CVSS score of this vulnerability is 8.3, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for clevertap-web-sdk.
