CleverTap Web SDK security vulnerabilities

The CleverTap Web SDK is an open-source developer toolkit developed by CleverTap. The CleverTap Web SDK versions 1.15.2 and earlier contain security vulnerabilities. These vulnerabilities stem from the insufficient source verification in the handleCustomHtmlPreviewPostMessageEvent function within...

CVE-2026-26861: Origin Validation Error

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting XSS via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes method, which can be bypassed ...