CVE-2026-75510

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.18.0 @novu/js versions prior to 3.18.0 @novu/react (Inbox component) versions prior to 3.18.0

Description Novu's In-App Inbox and the @novu/react Inbox component fail to validate the URL scheme of notification call-to-action redirects. An authenticated organization member or an environment API-key holder can store a javascript: redirect with a target set to self within an in-app workflow. When a recipient using a Chromium-based browser clicks the notification, the navigate() function in packages/js/src/ui/context/InboxContext.tsx calls window.open(), executing the arbitrary JavaScript in the current inbox-hosting origin. This occurs because the server-side inbox mapper in apps/api/src/app/inbox/utils/notification-mapper.ts and the client-side component in packages/js/src/ui/components/Notification/DefaultNotification.tsx pass the redirect.url and target from the cta.data object without validation. This can lead to stored Cross-Site Scripting (XSS), allowing the theft of session material, such as the self-hosted-jwt from localStorage, and permitting unauthorized authenticated actions within a customer application or the self-hosted Novu dashboard.

Recommendations Update Novu, @novu/js, and @novu/react to version 3.18.0 or later. As a temporary workaround, restrict the permissions of users who can create or edit in-app workflows to prevent the insertion of malicious javascript: URLs in the cta.data object.