{"action":"Upgrade clevertap-web-sdk to 1.15.3 or later.","affected":[{"fixed":"1.15.3","introduced":"0"}],"component":"clevertap-web-sdk","cve_ids":["CVE-2026-26861"],"ecosystem":"npm","epss":0.00205,"exploited":false,"fixed_versions":["1.15.3"],"ghsa_id":"GHSA-j5mf-6rh3-rhgg","id":"tcs_01M5KFX2CV1VNQ475135262CWT","modified_at":"2026-03-04T15:12:09.217040Z","published_at":"2026-02-27T18:31:06Z","references":["https://osv.dev/vulnerability/GHSA-j5mf-6rh3-rhgg","https://nvd.nist.gov/vuln/detail/CVE-2026-26861","https://github.com/CleverTap/clevertap-web-sdk/issues/424","https://github.com/CleverTap/clevertap-web-sdk/pull/417","https://github.com/CleverTap/clevertap-web-sdk/commit/84695b726a751614ddc3a4f71382c239c5833e03","https://github.com/CleverTap/clevertap-web-sdk","https://github.com/CleverTap/clevertap-web-sdk/blob/cf1b65d/src/util/campaignRender/nativeDisplay.js#L118-L121"],"severity":{"label":"high","score":8.3},"sources":[{"source":"osv","source_id":"GHSA-j5mf-6rh3-rhgg","url":"https://osv.dev/vulnerability/GHSA-j5mf-6rh3-rhgg"}],"summary":"CleverTap Web SDK is vulnerable to DOM-based XSS via handleCustomHtmlPreviewPostMessageEvent function"}