Description
CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes() method, which can be bypassed by an attacker using a subdomain.
Recommendation
Update the clevertap-web-sdk package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.15.3
- Patched version(s): 1.15.3
References
Could your website be exposed too?
SmartScanner can check your website for CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function and gives you actionable findings to investigate.
Start a free scanRelated Issues
- CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage - CVE-2026-26862
- TeleJSON: DOM XSS via unsanitised constructor name in `new Function()` - CVE-2026-47099
- Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State - CVE-2026-42573
- wetty vulnerable to DOM XSS via file-download filename - CVE-2026-49864
You might also like:
See something that needs correcting? Let us knowUpdated March 01, 2026