CVE-2026-26862: CleverTap Web SDK XSS Vulnerability

CVE-2026-26862 Overview

CVE-2026-26862 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the CleverTap Web SDK affecting version 1.15.2 and earlier. The flaw resides in the Visual Builder module at src/modules/visualBuilder/pageBuilder.js, where origin validation for window.postMessage events is implemented incorrectly. The code uses the JavaScript includes() method to check whether originUrl contains the string dashboard.clevertap.com, allowing attackers to bypass the check using crafted subdomains or paths. Successful exploitation lets remote attackers execute arbitrary script in the context of any web application embedding the SDK. The vulnerability is tracked under CWE-79 and requires user interaction to trigger the postMessage handler.

Critical Impact
Attackers can execute arbitrary JavaScript in the browser context of sites embedding the CleverTap Web SDK, enabling session theft, credential harvesting, and account takeover.

Affected Products

CleverTap Web SDK version 1.15.2
All CleverTap Web SDK versions prior to 1.15.2
Web applications embedding the vulnerable SDK with Visual Builder enabled

Discovery Timeline

2026-02-27 - CVE CVE-2026-26862 published to NVD
2026-03-03 - Last updated in NVD database

Technical Details for CVE-2026-26862

Vulnerability Analysis

The CleverTap Web SDK Visual Builder uses window.postMessage to receive configuration commands from the CleverTap dashboard. To prevent untrusted origins from sending messages, the SDK validates the sender's originUrl before processing the payload. The validation at lines 56-60 of pageBuilder.js calls originUrl.includes("dashboard.clevertap.com") instead of performing a strict origin comparison.

String containment checks are insufficient for origin validation. An attacker who controls a domain such as dashboard.clevertap.com.attacker.tld or attacker.tld/?x=dashboard.clevertap.com satisfies the includes() check. Once validation passes, the message payload is processed and reaches a sink that injects content into the DOM, producing script execution in the embedding site's origin.

Root Cause

The root cause is improper origin validation using substring matching. The correct pattern compares event.origin to an exact allowlist of full origin strings, for example https://dashboard.clevertap.com. The vulnerable implementation parses originUrl from message data and relies on String.prototype.includes(), which returns true for any URL containing the trusted string anywhere in its value.

Attack Vector

Exploitation requires the victim to visit an attacker-controlled page while authenticated to or browsing a site that embeds the CleverTap Web SDK. The attacker page opens or frames the target site and calls targetWindow.postMessage() with a crafted originUrl field that bypasses the substring check. The Visual Builder handler accepts the message and processes the embedded payload, resulting in script execution under the target site's origin.

The vulnerability is described in prose because no verified proof-of-concept code is available. See the GitHub source code reference for the affected validation logic and GitHub Issue #442 for the disclosure discussion.

Detection Methods for CVE-2026-26862

Indicators of Compromise

Unexpected postMessage events received by pages embedding the CleverTap Web SDK from origins other than https://dashboard.clevertap.com
Inline script execution or DOM mutation events originating from the Visual Builder module on production pages where Visual Builder is not in active use
Outbound requests to attacker-controlled domains containing the substring dashboard.clevertap.com in hostnames or paths

Detection Strategies

Audit deployed pages to identify the loaded CleverTap Web SDK version and flag any instance at or below 1.15.2
Deploy a Content Security Policy (CSP) with script-src restrictions and review CSP violation reports for blocked inline scripts on pages using the SDK
Inspect browser telemetry and Real User Monitoring data for anomalous postMessage traffic targeting the Visual Builder handler

Monitoring Recommendations

Forward web server access logs and CSP violation reports to a centralized analytics platform and alert on spikes in script-related violations
Monitor authentication systems for session anomalies on user accounts that may indicate XSS-driven session hijacking
Track CleverTap GitHub advisories and the project changelog for updated SDK releases addressing this issue

How to Mitigate CVE-2026-26862

Immediate Actions Required

Inventory all web properties that embed the CleverTap Web SDK and identify those running version 1.15.2 or earlier
Upgrade the CleverTap Web SDK to the patched release once available from the vendor, tracked in GitHub Pull Request #417
Apply a strict Content Security Policy that blocks inline script execution and restricts script sources to trusted origins

Patch Information

The vendor remediation is tracked in GitHub Pull Request #417 against the CleverTap Web SDK repository. The fix replaces the includes() substring check with a strict origin comparison against an allowlist of trusted CleverTap dashboard origins. Review the linked GitHub Issue #442 for vendor confirmation and patch status before deployment.

Workarounds

Disable or remove the Visual Builder module from production deployments where it is not required for active campaign editing
Restrict CleverTap Web SDK loading to authenticated administrative pages only, isolating it from high-value user sessions
Add a custom message event listener that validates event.origin against an exact allowlist before the SDK handler executes

bash

# Example Content-Security-Policy header to limit XSS impact
Content-Security-Policy: default-src 'self'; script-src 'self' https://*.clevertap.com; frame-ancestors 'none'; report-uri /csp-report