AIKIDO-2025-10332

TL;DR

Affected versions of this package are vulnerable to a security bypass due to improper origin validation in the handleMessageEvent function, which uses includes() for loose domain matching (e.g., allowing evil.clevertap.com if the trusted domain was clevertap.com). An attacker who compromises any subdomain can bypass origin validation and conduct malicious postMessage spoofing attempts, potentially leading to Cross-site Scripting (XSS) or click-jacking attacks.