PT-2026-22366 · Clevertap · Clevertap Web Sdk

Mr-Neutr0N · Publicado 2026-02-27 · Atualizado 2026-03-04 · CVE-2026-26861

Positive Technologies (AI Summary)

CVSS v3.1

8.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions CleverTap Web SDK versions 1.15.2 and earlier

Description The CleverTap Web SDK is susceptible to a Cross-Site Scripting (XSS) issue through the window.postMessage functionality. The handleCustomHtmlPreviewPostMessageEvent function, located in src/util/campaignRender/nativeDisplay.js, does not adequately validate the message origin using the includes() method, allowing attackers to bypass security checks by utilizing a subdomain.

Recommendations Update CleverTap Web SDK to a version later than 1.15.2.

Correção

Origin Validation Error

XSS

Enumeração de Fraquezas

CWE-346

CWE-79

Identificadores relacionados

CVE-2026-26861

GHSA-J5MF-6RH3-RHGG

Produtos afetados

Clevertap Web Sdk

Referências · 12

• https://github.com/CleverTap/clevertap-web-sdk/pull/417 · Correção
• https://github.com/CleverTap/clevertap-web-sdk · Nota
• https://github.com/CleverTap/clevertap-web-sdk/blob/cf1b65d/src/util/campaignRender/nativeDisplay.js#L118-L121 · Nota
• https://github.com/CleverTap/clevertap-web-sdk/issues/424 · Aviso do Fabricante
• https://github.com/CleverTap/clevertap-web-sdk/commit/84695b726a751614ddc3a4f71382c239c5833e03 · Nota
• https://t.me/CVEtracker/46003 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2027466611033313358 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2027488857110069613 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-j5mf-6rh3-rhgg · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-26861 · Aviso do Fabricante
• https://twitter.com/cracbot/status/2029150049578717235 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-26861 · Nota de Segurança