The CleverTap Web SDK v1.15.1 is vulnerable to an XSS attack because it fails to sanitize untrusted input received through window.postMessage before injecting it into the DOM. Specifically, the renderCustomHtml function processes this input unsafely, enabling execution of arbitrary JavaScript in the context of the hosting site. This vulnerability could be exploited by an attacker crafting a malicious message to trigger script execution.

Successful exploitation allows an attacker to execute arbitrary JavaScript code within the context of the affected web application, potentially leading to session hijacking, data theft, or other malicious actions depending on the privileges of the script.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using version 1.15.1 of the CleverTap Web SDK or implement additional input validation and sanitization on messages received via window.postMessage to prevent injection of malicious scripts.