CVE-2026-26862: CleverTap Web SDK DOM-based XSS via postMessage origin bypass

CVE-2026-26862 · Severity: low · CVSS 3.1 · Published 2026-02-27

CleverTap Web SDK is a JavaScript library that customer websites embed to enable customer engagement features like visual campaigns. A DOM-based cross-site scripting (XSS) vulnerability in the SDK's Visual Builder module allows attackers to inject malicious JavaScript into web pages by bypassing the origin validation check. An attacker can craft a malicious postMessage that includes a crafted subdomain to bypass the origin check, then inject arbitrary HTML/JavaScript that executes in the context of the victim's website, potentially stealing user data or hijacking sessions.

Technologies: CleverTap Web SDK. Vendors: CleverTap, npm.

Quick answers

Is CVE-2026-26862 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-26862 being exploited in the wild.
How severe is CVE-2026-26862?
Low severity, with a CVSS score of 3.1, published 27 February 2026.
Which products and versions are affected?
CleverTap Web SDK ≤ 1.15.2; clevertap-web-sdk (npm) SEMVER:introduced=0,fixed=1.15.3.
Is there a fix for CVE-2026-26862?
Yes. clevertap-web-sdk (npm): upgrade to 1.15.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26862 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-26862?
Check whether you run CleverTap Web SDK or clevertap-web-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • clevertap-web-sdk (npm): upgrade to 1.15.3 or later
    npm install clevertap-web-sdk@1.15.3

Technical details

The vulnerability is a DOM-based cross-site scripting (XSS) flaw in the Visual Builder module of CleverTap Web SDK versions ≤ 1.15.2. The root cause lies in two flaws: (1) insufficient origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) that uses the String.includes() method to check if the origin contains "dashboard.clevertap.com", allowing bypass via crafted subdomains like "attacker.dashboard.clevertap.com"; and (2) unsanitized DOM manipulation where the renderVisualBuilder() function directly assigns user-controlled HTML to element.outerHTML without sanitization. An attacker can send a crafted postMessage event from any origin with a payload containing malicious HTML/JavaScript. The attack requires user interaction (opening a malicious page or link) but no authentication. The vulnerability is fixed in version 1.15.3.

Affected products

  • CleverTap Web SDK ≤ 1.15.2

Identifiers

  • CVE-2026-26862
  • GHSA-jfrq-hj9f-c8qx

Timeline

  • 2025-07-13: disclosed: Vulnerability reported on GitHub issue #442
  • 2026-02-27: advisory: GHSA advisory published
  • 2026-02-27: patched: Fixed in version 1.15.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.