{"action":"Upgrade clevertap-web-sdk to 1.15.3 or later.","affected":[{"fixed":"1.15.3","introduced":"0"}],"component":"clevertap-web-sdk","cve_ids":["CVE-2026-26862"],"ecosystem":"npm","epss":0.00422,"exploited":false,"fixed_versions":["1.15.3"],"ghsa_id":"GHSA-jfrq-hj9f-c8qx","id":"tcs_01M5KFXXBH28MH7ZS4SWN3T43M","modified_at":"2026-03-04T15:12:09.545600Z","published_at":"2026-02-27T18:31:06Z","references":["https://osv.dev/vulnerability/GHSA-jfrq-hj9f-c8qx","https://nvd.nist.gov/vuln/detail/CVE-2026-26862","https://github.com/CleverTap/clevertap-web-sdk/issues/442","https://github.com/CleverTap/clevertap-web-sdk/pull/417","https://github.com/CleverTap/clevertap-web-sdk/commit/766f75f0c9082a27eb0b59c9fa4b0d9b19ba3d10","https://github.com/CleverTap/clevertap-web-sdk/commit/84695b726a751614ddc3a4f71382c239c5833e03","https://github.com/CleverTap/clevertap-web-sdk","https://github.com/CleverTap/clevertap-web-sdk/blob/cf1b65d/src/modules/visualBuilder/pageBuilder.js#L56-L60"],"severity":{"label":"high","score":8.3},"sources":[{"source":"osv","source_id":"GHSA-jfrq-hj9f-c8qx","url":"https://osv.dev/vulnerability/GHSA-jfrq-hj9f-c8qx"}],"summary":"CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage"}