VYPR
← All advisories
High severity8.3NVD Advisory· Published Feb 27, 2026· Updated Jun 17, 2026

CVE-2026-26861

CVE-2026-26861

Description

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes() method, which can be bypassed by an attacker using a subdomain

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
clevertap-web-sdknpm
< 1.15.31.15.3

Affected products

3
  • CleverTap/Web SDK2 versions
    cpe:2.3:a:clevertap:clevertap_web_sdk:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:clevertap:clevertap_web_sdk:*:*:*:*:*:*:*:*range: <=1.15.2
    • (no CPE)
  • ghsa-coords
    pkg:npm/clevertap-web-sdk
    Range: < 1.15.3

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.