Is CVE-2026-26861 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-26861 being exploited in the wild.

How severe is CVE-2026-26861?

Low severity, with a CVSS score of 3.1, published 27 February 2026.

Which products and versions are affected?

CleverTap Web SDK 1.15.2 and earlier; clevertap-web-sdk (npm) SEMVER:introduced=0,fixed=1.15.3.

Is there a fix for CVE-2026-26861?

Yes. clevertap-web-sdk (npm): upgrade to 1.15.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-26861 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-26861?

Check whether you run CleverTap Web SDK or clevertap-web-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-26861: CleverTap Web SDK DOM-based XSS in postMessage handler

CVE-2026-26861 · Severity: low · CVSS 3.1 · Published 2026-02-27

CleverTap Web SDK is a JavaScript library that customer websites embed to enable analytics and in-app messaging campaigns. A flaw in its message handler allows attackers to inject malicious JavaScript code that executes in the context of any website using the SDK, potentially stealing session cookies, performing unauthorized actions on behalf of users, or defacing web pages. The vulnerability requires user interaction (loading a malicious page) but affects all websites using vulnerable SDK versions.

Technologies: CleverTap Web SDK. Vendors: CleverTap, npm.

Quick answers

Is CVE-2026-26861 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-26861 being exploited in the wild.
How severe is CVE-2026-26861?: Low severity, with a CVSS score of 3.1, published 27 February 2026.
Which products and versions are affected?: CleverTap Web SDK 1.15.2 and earlier; clevertap-web-sdk (npm) SEMVER:introduced=0,fixed=1.15.3.
Is there a fix for CVE-2026-26861?: Yes. clevertap-web-sdk (npm): upgrade to 1.15.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26861 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-26861?: Check whether you run CleverTap Web SDK or clevertap-web-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

clevertap-web-sdk (npm): upgrade to 1.15.3 or later
```
npm install clevertap-web-sdk@1.15.3
```

Technical details

The vulnerability is a DOM-based Cross-Site Scripting (XSS) flaw in the handleCustomHtmlPreviewPostMessageEvent function in nativeDisplay.js. The SDK listens for window.postMessage events and unsafely injects the display.details[0].html field directly into the page DOM via innerHTML without proper sanitization. Although version 1.15.2 introduced an origin check, it uses the string.includes() method to validate event.origin against "clevertap.com", which can be bypassed by attacker-controlled subdomains (e.g., dashboard.clevertap.attacker.com). An attacker can craft a malicious postMessage payload embedding arbitrary HTML/JavaScript (e.g., img onerror handlers) that executes when rendered. Fix: Update to version 1.15.3 or later, which implements proper origin validation.

Affected products

CleverTap Web SDK 1.15.2 and earlier

Identifiers

CVE-2026-26861
GHSA-j5mf-6rh3-rhgg

Timeline

2026-02-27: disclosed: Vulnerability published in NVD and GitHub Advisory
2026: patched: Fix released in version 1.15.3

References

https://github.com/CleverTap/clevertap-web-sdk/issues/424

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.