CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of arbitrary JavaScript in the context of the hosting site.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Clevertap |
|
No data.
No data.
References
| Link | Providers |
|---|---|
| https://github.com/CleverTap/clevertap-web-sdk/issues/416 |
|
History
Thu, 30 Jul 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Clevertap
Clevertap web Sdk |
|
| Vendors & Products |
Clevertap
Clevertap web Sdk |
Thu, 30 Jul 2026 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of arbitrary JavaScript in the context of the hosting site. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2026-07-30T00:00:00.000Z
Updated: 2026-07-30T19:57:30.163Z
Reserved: 2025-06-16T00:00:00.000Z
Link: CVE-2025-51684
Vulnrichment
No data.
NVD
No data.
Redhat
No data.