Medium, CVSS 5.1npmAmendedPublished
Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme
CVE-2026-75510 · GHSA-8gr3-5j6f-25gp
- Affected
- npm @novu/js <= 3.17.0
- Fixed in
- 3.18.0· Vendor fix available
- Issue
- The @novu/js In-App Inbox renderer passes a notification's redirect.url to window.open() with no URL-scheme validation. The value originates from a notification's call-to-action and is delivered to the recipient verbatim. An authenticated organization member (or any holder of the environment API key) creates a v1 in-app workflow whose step CTA stores cta.data = { url: "javascript:<payload", target: "self" }. The v1 message-template cta.data field is a Mongoose Mixed type, so the arbitrary target key is accepted and persisted. The server-side inbox mapper copies cta.data.url and cta.data.target into the notification's redirect object with no scheme check. Novu's v2 control schema validates redirect URLs against redirectUrlRegex (which rejects javascript:), proving the intended invariant; the v1 path and the client renderer do not enforce it. When the recipient clicks the notification, the inbox calls window.open(url, "self", "noopener noreferrer"). In Chromium browsers a…
Recommended action: Upgrade to 3.18.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.