leanplum-sdk (1.13.0) potentially affected by CVE-2025-51684 via clevertap-web-sdk (1.9.2)

clevertap-web-sdk NPM version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on clevertap-web-sdk and may be impacted: - leanplum-sdk 1.13.0 Source cves: CVE-2025-51684 Source advisory: SNYK:JS-CLEVERTAPWEBSDK-18508175...

Cross-site Scripting (XSS)

Overview clevertap-web-sdk is a Affected versions of this package are vulnerable to Cross-site Scripting XSS in the renderCustomHtml function of src/util/campaignRender/nativeDisplay.js, which assigns the display.details0.html field from an incoming postMessage to element.innerHTML without...

CVE-2025-51684

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting XSS. The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of...

CVE-2025-51684

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting XSS. The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of...

CVE-2025-51684: Improper Neutralization of Input During Web Page Generation

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting XSS. The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of...

CVE-2025-51684

The CleverTap Web SDK (version 1.15.1 ) is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the renderCustomHtml() function in src/util/campaignRender/nativeDisplay.js fails to sanitize untrusted data received via window.po...

CVE-2025-51684

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting XSS. The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of...

EUVD-2025-210564

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting XSS. The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of...

CVE-2026-26861

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting XSS via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes method, which can be bypassed ...

leanplum-sdk (1.13.0) potentially affected by CVE-2026-26861 via clevertap-web-sdk (1.9.2)

clevertap-web-sdk NPM version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on clevertap-web-sdk and may be impacted: - leanplum-sdk 1.13.0 Source cves: CVE-2026-26861 Source advisory: SNYK:JS-CLEVERTAPWEBSDK-15366963...

leanplum-sdk (1.13.0) potentially affected by CVE-2026-26862 via clevertap-web-sdk (1.9.2)

clevertap-web-sdk NPM version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on clevertap-web-sdk and may be impacted: - leanplum-sdk 1.13.0 Source cves: CVE-2026-26862 Source advisory: OSV:GHSA-JFRQ-HJ9F-C8QX...

CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting XSS via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js lines 56-60 uses the includes method to verify the originUrl contains...

EUVD-2026-9039

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting XSS via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js lines 56-60 uses the includes method to verify the originUrl contains...

leanplum-sdk (1.13.0) potentially affected by CVE-2026-26861 via clevertap-web-sdk (1.9.2)

clevertap-web-sdk NPM version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on clevertap-web-sdk and may be impacted: - leanplum-sdk 1.13.0 Source cves: CVE-2026-26861 Source advisory: OSV:GHSA-J5MF-6RH3-RHGG...

EUVD-2026-9038

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting XSS via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes method, which can be bypassed ...

GHSA-J5MF-6RH3-RHGG CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-site Scripting XSS via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes method, which can be bypassed ...

CVE-2026-26861

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting XSS via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes method, which can be bypassed ...

CVE-2026-26861: Origin Validation Error

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting XSS via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes method, which can be bypassed ...

CleverTap Web SDK 安全漏洞

The CleverTap Web SDK is an open-source developer toolkit developed by CleverTap. The CleverTap Web SDK versions 1.15.2 and earlier contain security vulnerabilities. These vulnerabilities stem from the insufficient source verification in the handleCustomHtmlPreviewPostMessageEvent function within...

CVE-2026-26862

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting XSS via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js lines 56-60 uses the includes method to verify the originUrl contains...