Description
CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of arbitrary JavaScript in the context of the hosting site.
Published: 2026-07-30
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

CleverTap Web SDK version 1.15.1 fails to sanitize data received through window.postMessage before inserting it into the DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, injects arbitrary JavaScript and executes it within the context of the hosting page. This allows the attacker to acquire full control of the page, steal user data, and perform further actions on the user’s behalf.

Affected Systems

The vulnerability affects CleverTap Web SDK v1.15.1. No other affected versions are listed.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of <1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploits as of now. Attackers would need to send a crafted window.postMessage to a page that includes the SDK; if successful the injected script runs with the privileges of the hosting page, allowing arbitrary code execution in that context.

Generated by OpenCVE AI on August 2, 2026 at 07:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest CleverTap Web SDK version if available
  • If an update is not immediately possible, apply client‑side validation to any data received via window.postMessage before inserting it into the DOM; use a whitelist of expected properties and escape or sanitize content
  • Enforce a strict Content Security Policy for the hosting page to restrict execution of inline scripts and reduce the impact of any remaining XSS vector

Generated by OpenCVE AI on August 2, 2026 at 07:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 08:00:00 +0000

Type Values Removed Values Added
Title Unvalidated window.postMessage Leads to XSS in CleverTap Web SDK

Fri, 31 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Clevertap
Clevertap web Sdk
Vendors & Products Clevertap
Clevertap web Sdk

Thu, 30 Jul 2026 20:15:00 +0000

Type Values Removed Values Added
Description CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of arbitrary JavaScript in the context of the hosting site.
References

Subscriptions

Clevertap Web Sdk
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-07-31T19:11:17.155Z

Reserved: 2025-06-16T00:00:00.000Z

Link: CVE-2025-51684

cve-icon Vulnrichment

Updated: 2026-07-31T19:11:13.321Z

cve-icon NVD

Status : Received

Published: 2026-07-30T20:16:51.793

Modified: 2026-07-31T20:16:44.277

Link: CVE-2025-51684

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T07:45:03Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')