# CVE-2026-26862: CleverTap Web SDK DOM-based XSS via postMessage origin bypass

Source: https://junglewise.ai/threats/cve-2026-26862-clevertap-web-sdk-dom-based-xss-via-postmessage-origin-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-26862 · Severity: low · CVSS 3.1 · Published 2026-02-27

CleverTap Web SDK is a JavaScript library that customer websites embed to enable customer engagement features like visual campaigns. A DOM-based cross-site scripting (XSS) vulnerability in the SDK's Visual Builder module allows attackers to inject malicious JavaScript into web pages by bypassing the origin validation check. An attacker can craft a malicious postMessage that includes a crafted subdomain to bypass the origin check, then inject arbitrary HTML/JavaScript that executes in the context of the victim's website, potentially stealing user data or hijacking sessions.

Technologies: [CleverTap Web SDK](https://junglewise.ai/threats/technologies/web-sdk). Vendors: [CleverTap](https://junglewise.ai/threats/vendors/clevertap), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-26862 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26862 being exploited in the wild.

**How severe is CVE-2026-26862?** Low severity, with a CVSS score of 3.1, published 27 February 2026.

**Which products and versions are affected?** CleverTap Web SDK ≤ 1.15.2; clevertap-web-sdk (npm) SEMVER:introduced=0,fixed=1.15.3.

**Is there a fix for CVE-2026-26862?** Yes. clevertap-web-sdk (npm): upgrade to 1.15.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-26862 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-26862?** Check whether you run CleverTap Web SDK or clevertap-web-sdk (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- clevertap-web-sdk (npm): upgrade to 1.15.3 or later

  ```sh
  npm install clevertap-web-sdk@1.15.3
  ```


## Technical details

The vulnerability is a DOM-based cross-site scripting (XSS) flaw in the Visual Builder module of CleverTap Web SDK versions ≤ 1.15.2. The root cause lies in two flaws: (1) insufficient origin validation in src/modules/visualBuilder/pageBuilder.js (lines 56-60) that uses the String.includes() method to check if the origin contains "dashboard.clevertap.com", allowing bypass via crafted subdomains like "attacker.dashboard.clevertap.com"; and (2) unsanitized DOM manipulation where the renderVisualBuilder() function directly assigns user-controlled HTML to element.outerHTML without sanitization. An attacker can send a crafted postMessage event from any origin with a payload containing malicious HTML/JavaScript. The attack requires user interaction (opening a malicious page or link) but no authentication. The vulnerability is fixed in version 1.15.3.

## Affected products

- CleverTap Web SDK ≤ 1.15.2

## Identifiers

- CVE-2026-26862
- GHSA-jfrq-hj9f-c8qx

## Timeline

- 2025-07-13: disclosed: Vulnerability reported on GitHub issue #442
- 2026-02-27: advisory: GHSA advisory published
- 2026-02-27: patched: Fixed in version 1.15.3

## References

- [https://github.com/CleverTap/clevertap-web-sdk/issues/442](https://github.com/CleverTap/clevertap-web-sdk/issues/442)

## Related threats

- [CleverTap Web SDK DOM XSS via postMessage in renderCustomHtml](https://junglewise.ai/threats/cve-2025-51684-clevertap-web-sdk-dom-xss-via-postmessage-in-rendercustomhtml)
- [CleverTap Web SDK DOM-based XSS in postMessage handler](https://junglewise.ai/threats/cve-2026-26861-clevertap-web-sdk-dom-based-xss-in-postmessage-handler)