PT-2026-22366 · Clevertap · Clevertap Web Sdk

Mr-Neutr0N · Published 2026-02-27 · Updated 2026-03-04 · CVE-2026-26861

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions CleverTap Web SDK versions 1.15.2 and earlier

Description The CleverTap Web SDK is susceptible to a Cross-Site Scripting (XSS) issue through the window.postMessage functionality. The handleCustomHtmlPreviewPostMessageEvent function, located in src/util/campaignRender/nativeDisplay.js, does not adequately validate the message origin using the includes() method, allowing attackers to bypass security checks by utilizing a subdomain.

Recommendations Update CleverTap Web SDK to a version later than 1.15.2.

Fix

Origin Validation Error

XSS

Weakness Enumeration

CWE-346

CWE-79

Related Identifiers

CVE-2026-26861

GHSA-J5MF-6RH3-RHGG

Affected Products

Clevertap Web Sdk

References · 12

• https://github.com/CleverTap/clevertap-web-sdk/pull/417 · Patch
• https://github.com/CleverTap/clevertap-web-sdk/issues/424 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j5mf-6rh3-rhgg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26861 · Security Note
• https://github.com/CleverTap/clevertap-web-sdk · Note
• https://github.com/CleverTap/clevertap-web-sdk/blob/cf1b65d/src/util/campaignRender/nativeDisplay.js#L118-L121 · Note
• https://github.com/CleverTap/clevertap-web-sdk/commit/84695b726a751614ddc3a4f71382c239c5833e03 · Note
• https://t.me/CVEtracker/46003 · Telegram Post
• https://twitter.com/CVEnew/status/2027466611033313358 · Twitter Post
• https://twitter.com/TheHackerWire/status/2027488857110069613 · Twitter Post
• https://twitter.com/cracbot/status/2029150049578717235 · Twitter Post