Executive brief
CleverTap Web SDK, a tool used by websites to track user engagement and deliver personalized content, contains a security flaw that could allow an attacker to execute malicious code on a victim's website. By sending a specially crafted message to the browser window, an attacker can bypass security checks and run unauthorized scripts. This could lead to the theft of sensitive user information, session hijacking, or the unauthorized modification of website content.
Technical details
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in CleverTap Web SDK v1.15.1. The vulnerability stems from the SDK's failure to validate or sanitize the origin and content of messages received through the 'window.postMessage' interface. Specifically, the 'renderCustomHtml' function processes untrusted data from these messages and injects it directly into the Document Object Model (DOM). An attacker can exploit this by crafting a malicious message that, when received by a site using the vulnerable SDK, executes arbitrary JavaScript. This can occur without authentication if the attacker can trigger a postMessage to the target window, typically via a malicious site or iframe.
Affected products
- CleverTap Web SDK 1.15.1
Timeline
- 2026-07-30: disclosed
- 2026-07-30: advisory