Description
CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker.
This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CleverTap | Cordova Plugin | 2.6.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | clevertap-cordova | < 2.7.0 | 2.7.0 | GHSA-x2ph-qqwm-9cc6 |