{"id":"EUVD-2026-84535","revision":"f3bbd233b7be4ff0853cbbcc086ce3c2","records":[{"revision":"f3bbd233b7be4ff0853cbbcc086ce3c2","observedAt":"2026-11-01T12:02:54.606+00:00","statement":{"source":"euvd","id":"EUVD-2026-84535","aliases":["CVE-2026-75510","GHSA-8gr3-5j6f-25gp"],"title":"Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pa…","description":"Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through apps/api/src/app/inbox/utils/notification-mapper.ts and packages/js/src/ui/components/Notification/DefaultNotification.tsx to the navigate function in packages/js/src/ui/context/InboxContext.tsx without validating its URL scheme. An authenticated organization member or environment API-key holder can store a javascript: redirect with target _self in an in-app workflow. When a recipient using a Chromium-based browser clicks the notification, window.open executes the redirect in the current inbox-hosting origin, which can expose session material and permit authenticated actions in a customer application or the self-hosted Novu dashboard. This issue is fixed in version 3.18.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","score":5.1,"severity":null}],"references":["https://github.com/novuhq/novu/security/advisories/GHSA-8gr3-5j6f-25gp","https://github.com/novuhq/novu/pull/11453","https://github.com/novuhq/novu/commit/f105f3d41a4405a75f803634d49f15a967524d8a","https://github.com/novuhq/novu/releases/tag/v3.18.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-84535","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 22, 2026, 3:47:19 PM","dateUpdated":"Sep 22, 2026, 3:59:27 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-84535","identifiers":["EUVD-2026-84535","CVE-2026-75510","GHSA-8gr3-5j6f-25gp"]},"retained":false,"historicalAffected":[]}],"coverage":[]}