PT-2026-22368 · Clevertap · Clevertap Web Sdk

Mr-Neutr0N · Published 2026-02-27 · Updated 2026-03-04 · CVE-2026-26862

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions CleverTap Web SDK versions 1.15.2 and earlier

Description The CleverTap Web SDK is susceptible to a DOM-based Cross-Site Scripting (XSS) issue. This occurs due to insufficient origin validation within the Visual Builder module, specifically in the src/modules/visualBuilder/pageBuilder.js file (lines 56-60). The includes() method is used to verify the origin URL, but it can be bypassed with a crafted subdomain. The vulnerability is triggered through the window.postMessage function.

Recommendations Update CleverTap Web SDK to a version later than 1.15.2.

Fix

XSS

Weakness Enumeration

CWE-829

CWE-79

Related Identifiers

CVE-2026-26862

GHSA-JFRQ-HJ9F-C8QX

Affected Products

Clevertap Web Sdk

References · 14

• https://github.com/CleverTap/clevertap-web-sdk/issues/442 · Vendor Advisory
• https://github.com/CleverTap/clevertap-web-sdk/pull/417 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-26862 · Security Note
• https://osv.dev/vulnerability/GHSA-jfrq-hj9f-c8qx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26862 · Vendor Advisory
• https://github.com/CleverTap/clevertap-web-sdk/commit/766f75f0c9082a27eb0b59c9fa4b0d9b19ba3d10 · Note
• https://github.com/CleverTap/clevertap-web-sdk/commit/84695b726a751614ddc3a4f71382c239c5833e03 · Note
• https://github.com/CleverTap/clevertap-web-sdk/blob/cf1b65d/src/modules/visualBuilder/pageBuilder.js#L56-L60 · Note
• https://github.com/CleverTap/clevertap-web-sdk · Note
• https://twitter.com/CVEnew/status/2027466611842814309 · Twitter Post
• https://twitter.com/TheHackerWire/status/2027488905231290533 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2027490066562437360 · Twitter Post
• https://t.me/CVEtracker/46004 · Telegram Post
• https://twitter.com/cracbot/status/2029150051227074817 · Twitter Post