{"id":"EUVD-2026-84535","enisaUuid":"c5c128ee-c818-385e-b1eb-023f40c82d37","description":"Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu\u0027s @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through apps/api/src/app/inbox/utils/notification-mapper.ts and packages/js/src/ui/components/Notification/DefaultNotification.tsx to the navigate function in packages/js/src/ui/context/InboxContext.tsx without validating its URL scheme. An authenticated organization member or environment API-key holder can store a javascript: redirect with target _self in an in-app workflow. When a recipient using a Chromium-based browser clicks the notification, window.open executes the redirect in the current inbox-hosting origin, which can expose session material and permit authenticated actions in a customer application or the self-hosted Novu dashboard. This issue is fixed in version 3.18.0.","datePublished":"Sep 22, 2026, 3:47:19 PM","dateUpdated":"Sep 22, 2026, 3:59:27 PM","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/novuhq/novu/security/advisories/GHSA-8gr3-5j6f-25gp\nhttps://github.com/novuhq/novu/pull/11453\nhttps://github.com/novuhq/novu/commit/f105f3d41a4405a75f803634d49f15a967524d8a\nhttps://github.com/novuhq/novu/releases/tag/v3.18.0\n","aliases":"CVE-2026-75510\nGHSA-8gr3-5j6f-25gp\n","assigner":"GitHub_M","epss":0.48,"enisaIdProduct":[{"id":"b47a086a-d46d-328c-bd8a-fcfb9dd88ff6","product":{"name":"novu","vendor":{"name":"novuhq"}},"product_version":"\u003c 3.18.0"}],"enisaIdVendor":[{"id":"82e88d0b-e9b3-3d64-95bf-bc7f6748c6c6","vendor":{"name":"novuhq"}}],"enisaIdVulnerability":[{"id":"3d4f6d95-1dfa-3b25-8055-3e6b075f1534","vulnerability":{"id":"GHSA-8gr3-5j6f-25gp","description":"Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme","datePublished":"Sep 22, 2026, 8:34:35 PM","dateUpdated":"Sep 22, 2026, 8:34:35 PM","baseScore":0.0,"references":"https://github.com/novuhq/novu/security/advisories/GHSA-8gr3-5j6f-25gp\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-75510\nhttps://github.com/novuhq/novu/pull/11453\nhttps://github.com/novuhq/novu/commit/f105f3d41a4405a75f803634d49f15a967524d8a\nhttps://github.com/novuhq/novu\nhttps://github.com/novuhq/novu/releases/tag/v3.18.0\n","enisa_id":"EUVD-2026-84535\n","aliases":"CVE-2026-75510\nGHSA-8gr3-5j6f-25gp\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a6ae689d-2631-37a5-9577-e8f7601e1435","vulnerability":{"id":"CVE-2026-75510","description":"Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu\u0027s @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through apps/api/src/app/inbox/utils/notification-mapper.ts and packages/js/src/ui/components/Notification/DefaultNotification.tsx to the navigate function in packages/js/src/ui/context/InboxContext.tsx without validating its URL scheme. An authenticated organization member or environment API-key holder can store a javascript: redirect with target _self in an in-app workflow. When a recipient using a Chromium-based browser clicks the notification, window.open executes the redirect in the current inbox-hosting origin, which can expose session material and permit authenticated actions in a customer application or the self-hosted Novu dashboard. This issue is fixed in version 3.18.0.","datePublished":"Sep 22, 2026, 3:47:19 PM","dateUpdated":"Sep 22, 2026, 3:59:27 PM","status":"PUBLISHED","baseScore":5.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":"https://github.com/novuhq/novu/security/advisories/GHSA-8gr3-5j6f-25gp\nhttps://github.com/novuhq/novu/pull/11453\nhttps://github.com/novuhq/novu/commit/f105f3d41a4405a75f803634d49f15a967524d8a\nhttps://github.com/novuhq/novu/releases/tag/v3.18.0\n","enisa_id":"EUVD-2026-84535\n","assigner":"GitHub_M","epss":0.48,"dataProcessed":"Oct 28, 2026, 7:14:51 AM","vulnerabilityProduct":[{"id":"6477e7e3-2425-3a27-86ec-f2a82d6e67c6","product":{"name":"novu","vendor":{"name":"novuhq"}},"product_version":"\u003c 3.18.0"}],"vulnerabilityVendor":[{"id":"70b34614-de36-3102-a22f-b54f1d57877c","vendor":{"name":"novuhq"}}]}}],"enisaIdAdvisory":[]}