clevertap-web-sdk

Latest 3.1.0

84%

Total Score

healthy

Active organization-backed project with strong release evidence, but workflows leave all actions unpinned and lack bundled type declarations.

Are you affected? Scan for Free

Health Score Breakdown

Security policy

No repository security policy was found. This is a transparency gap, but active maintenance and security scanning partly compensate for it.

Type declarations

No type declarations are included. This is a real integration gap for TypeScript consumers of this browser SDK, although it does not indicate abandonment or unsafe packaging.

Workflow audit

All 15 analyzed action references are unpinned, and one release workflow has top-level write permissions; the audit also found a high-confidence low-severity adhoc package install. The cache-poisoning findings are low confidence and therefore hygiene concerns only, but the overall workflow setup merits caution.

Vulnerabilities

Title	Versions	Severity
CVE-2026-26862 clevertap-web-sdk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 1.15.3.	0.0.0 - 1.15.3	High
AIKIDO-2025-10849 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. clevertap-web-sdk is vulnerable to Improper Input Validation in versions 1.0.0 - 2.3.1.	1.0.0 - 2.3.1	Medium
AIKIDO-2025-10332 clevertap-web-sdk is vulnerable to Permissive Cross-domain Policy with Untrusted Domains in versions 1.14.2 - 1.15.2.	1.14.2 - 1.15.2	High
AIKIDO-2025-10320 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. clevertap-web-sdk is vulnerable to Cross-site Scripting (XSS) in versions 1.9.1 - 1.15.1.	1.9.1 - 1.15.1	Medium
AIKIDO-2025-10104 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. clevertap-web-sdk is vulnerable to Cross-site Scripting (XSS) in versions 1.0.0 - 1.12.1.	1.0.0 - 1.12.1	High