CVE-2026-75510 Details
Description
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through apps/api/src/app/inbox/utils/notification-mapper.ts and packages/js/src/ui/components/Notification/DefaultNotification.tsx to the navigate function in packages/js/src/ui/context/InboxContext.tsx without validating its URL scheme. An authenticated organization member or environment API-key holder can store a javascript: redirect with target _self in an in-app workflow. When a recipient using a Chromium-based browser clicks the notification, window.open executes the redirect in the current inbox-hosting origin, which can expose session material and permit authenticated actions in a customer application or the self-hosted Novu dashboard. This issue is fixed in version 3.18.0.
A stored cross-site scripting vulnerability has been identified in Novu's In-App Inbox feature, present in versions through 3.17.0. The issue arises because the In-App Inbox component accepts notification redirect URLs from the call-to-action data without validating the URL scheme. This flaw allows an authenticated user to inject a JavaScript URL that, when clicked by a recipient using a Chromium-based browser, executes the script in the context of the application's origin. This can lead to unauthorized access to session information and the ability to perform actions on behalf of the user.
Users can update to Novu version 3.18.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/novuhq/novu/security/advisories/GHSA-8gr3-5j6f-25gp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/novuhq/novu/commit/f105f3d41a4405a75f803634d49f15a967524d8a | [email protected] | Source CodeVendor |
| https://github.com/novuhq/novu/pull/11453 | [email protected] | Source CodeVendor |
| https://github.com/novuhq/novu/releases/tag/v3.18.0 | [email protected] | Release NotesVendor |
| https://github.com/novuhq/novu/security/advisories/GHSA-8gr3-5j6f-25gp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Novu | <= 3.17.0 (semver) |
CPE
Remediation
| |
| Novu JS | All versions |
CPE
Remediation
| |
| Novu React | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 22, 2026 | New CVE Received | [email protected] |
| Sep 22, 2026 | CVE Modified | CISA-ADP |