npmPackage

clevertap-web-sdk

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-26862High 8.3
CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage in the Visual…
Affected: fixed in 1.15.3.
Fixed in 1.15.3 (released May 28, 2025, 275 days before disclosure).
The latest release, 3.1.2, is not affected.
10% of clevertap-web-sdk downloads last week were affected versions (4.8K).
CVE-2026-26861High 8.3
CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting (XSS) via window.postMessage.
Affected: fixed in 1.15.3.
Fixed in 1.15.3 (released May 28, 2025, 275 days before disclosure).
The latest release, 3.1.2, is not affected.
10% of clevertap-web-sdk downloads last week were affected versions (4.8K).