The vulnerability in CleverTap Web SDK allows an attacker to inject malicious scripts into the DOM through the window.postMessage API. The Visual Builder module performs origin validation by checking if the origin URL contains the string "dashboard.clevertap.com" using the includes() method. An attacker can craft a subdomain that contains this string, bypassing the validation and delivering arbitrary JavaScript code to pages that load the SDK. This leads to the execution of attacker‑controlled code in the victim’s browser, compromising all data and functionality accessed by that user.

CleverTap Web SDK versions 1.15.2 and earlier are affected. The vulnerability resides in the src/modules/visualBuilder/pageBuilder.js component of the SDK. Any web application that incorporates the SDK and uses the Visual Builder module shares this risk.

The CVSS score of 8.3 indicates a high severity impact. The EPSS score is reported as less than 1%, suggesting that, at present, the likelihood of exploitation is low, yet an attacker with the ability to register or control a subdomain can still bypass the origin check. The vulnerability is not listed in the CISA KEV catalog, meaning no known active exploits are documented. The attack vector is remote, requiring the attacker to host a malicious page that sends a postMessage to the SDK with a crafted origin that passes the lenient includes() check.