CVE-2026-75510
Received Received - Intake

Open Redirect in Novu In-App Inbox Component

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through apps/api/src/app/inbox/utils/notification-mapper.ts and packages/js/src/ui/components/Notification/DefaultNotification.tsx to the navigate function in packages/js/src/ui/context/InboxContext.tsx without validating its URL scheme. An authenticated organization member or environment API-key holder can store a javascript: redirect with target _self in an in-app workflow. When a recipient using a Chromium-based browser clicks the notification, window.open executes the redirect in the current inbox-hosting origin, which can expose session material and permit authenticated actions in a customer application or the self-hosted Novu dashboard. This issue is fixed in version 3.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-75510
EUVD
EUVD-2026-84535

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
novu js to 3.15.0 (exc)
novu react to 3.15.0 (exc)
novu novu to 3.18.0 (exc)
novu js to 3.18.0 (exc)
novu react to 3.18.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Novu's In-App Inbox feature. It allows authenticated users to inject a javascript: URL redirect into notifications. When clicked in a Chromium-based browser, this executes arbitrary JavaScript in the current origin, potentially exposing session data or allowing unauthorized actions in the customer app or Novu dashboard.

Detection Guidance

Check Novu version for installations below 3.18.0. Inspect notification workflows for javascript: URLs in redirect.url fields. Monitor browser console logs for window.open calls with suspicious origins.

Impact Analysis

An attacker with access could steal session tokens or perform actions on your behalf. Users clicking malicious notifications might have their accounts compromised or see unauthorized changes in the application or Novu dashboard.

Compliance Impact

This vulnerability could potentially violate GDPR and HIPAA compliance by enabling unauthorized access to session tokens or sensitive data through a stored XSS attack. Exploitation may lead to data breaches, unauthorized actions, or exposure of protected health information, depending on the application context.

Mitigation Strategies

Upgrade Novu to version 3.18.0 or later. Review and remove any existing javascript: redirect URLs in notification workflows. Audit API keys and organization member permissions for unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75510. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart