What is GHSA-j5mf-6rh3-rhgg?

GHSA-j5mf-6rh3-rhgg is a security advisory published by GitHub Security Advisories with High severity. CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function

Which CVE IDs does GHSA-j5mf-6rh3-rhgg cover?

GHSA-j5mf-6rh3-rhgg covers the following CVE IDs: CVE-2026-26861. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-j5mf-6rh3-rhgg?

GHSA-j5mf-6rh3-rhgg has a CVSS v3 base score of 8.3, published by GitHub Security Advisories.

Which products are affected by GHSA-j5mf-6rh3-rhgg?

GHSA-j5mf-6rh3-rhgg affects 1 product, including: npm/clevertap-web-sdk:\u003c 1.15.3.

GHSA-j5mf-6rh3-rhggHighCVSS 8.3

CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function

Vendor

GitHub Security Advisories

Published

February 27, 2026

Last Modified

March 1, 2026

🔗 CVE IDs covered (1)

CVE-2026-26861 →

📋 Description

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-site Scripting (XSS) via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes() method, which can be bypassed by an attacker using a subdomain.

🎯 Affected products1

npm/clevertap-web-sdk:< 1.15.3

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2026-26861
https://github.com/CleverTap/clevertap-web-sdk/issues/424
https://github.com/CleverTap/clevertap-web-sdk/pull/417
https://github.com/CleverTap/clevertap-web-sdk/blob/cf1b65d/src/util/campaignRender/nativeDisplay.js#L118-L121
https://github.com/CleverTap/clevertap-web-sdk/commit/84695b726a751614ddc3a4f71382c239c5833e03
https://github.com/advisories/GHSA-j5mf-6rh3-rhgg