GHSA-8GR3-5J6F-25GP Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Summary The @novu/js In-App Inbox renderer passes a notification's redirect.url to window.open with no URL-scheme validation. The value originates from a notification's call-to-action and is delivered to the recipient verbatim. An authenticated organization member or any holder of the environment...

@novu/nextjs (>=3.0.0-canary.0, <=3.17.0), @novu/react (>=3.0.0-canary.0, <=3.17.0) +1 more potentially affected by CVE-2026-75510 via @novu/js (>=3.0.0-canary.0, <=3.17.0)

@novu/js NPM version =3.0.0-canary.0, =3.0.0-canary.0, =3.0.0-canary.0, =2.6.8, =3.17.0 Source cves: CVE-2026-75510 Source advisory: GHSA-8GR3-5J6F-25GP...

@novu/nextjs (>=3.0.0-canary.0, <=3.17.1-rc.1-rc.da35e9062d), @novu/react (>=3.0.0-canary.0, <=3.17.1-rc.1-rc.da35e9062d) +1 more potentially affected by CVE-2026-75510 via @novu/js (>=3.0.0-canary.0, <=3.17.1-rc.1-rc.da35e9062d)

@novu/js NPM version =3.0.0-canary.0, =3.0.0-canary.0, =3.0.0-canary.0, =2.6.8, =3.17.1-rc.1-rc.da35e9062d Source cves: CVE-2026-75510 Source advisory: OSV:GHSA-8GR3-5J6F-25GP...

CVE-2026-75510

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

@apolitical/component-library (>=8.3.5-ac.0, <=8.3.18-beta.0), @novu/nextjs (>=2.5.0, <=3.17.1-rc.1-rc.da35e9062d) +2 more potentially affected by CVE-2026-75510 via @novu/js (>=2.6.3, <=3.17.1-rc.1-rc.da35e9062d)

@novu/js NPM version =2.6.3, =8.3.5-ac.0, =2.5.0, =2.0.0-alpha.0, =2.2.0-rc.2, =3.17.1-rc.1-rc.da35e9062d Source cves: CVE-2026-75510 Source advisory: MEND:CVE-2026-75510...

CVE-2026-75510 Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...

PT-2026-96788

Name of the Vulnerable Software and Affected Versions Novu versions prior to 3.18.0 @novu/js versions prior to 3.18.0 @novu/react Inbox component versions prior to 3.18.0 Description Novu's In-App Inbox and the @novu/react Inbox component fail to validate the URL scheme of notification...

CVE-2026-75510: Improper Neutralization of Input During Web Page Generation

Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through...