https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 17:40:32 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-75510 <p>Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu&#39;s @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through apps/api/src/app/inbox/utils/notification-mapper.ts and packages/js/src/ui/components/Notification/DefaultNotification.tsx to the navigate function in packages/js/src/ui/context/InboxContext.tsx without validating its URL scheme. An authenticated organization member or environment API-key holder can store a javascript: redirect with target _self in an in-app workflow. When a recipient using a Chromium-based browser clicks the notification, window.open executes the redirect in the current inbox-hosting origin, which can expose session material and permit authenticated actions in a customer application or the self-hosted Novu dashboard. This issue is fixed in version 3.18.0.</p> <p>Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu&#39;s @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through apps/api/src/app/inbox/utils/notification-mapper.ts and packages/js/src/ui/components/Notification/DefaultNotification.tsx to the navigate function in packages/js/src/ui/context/InboxContext.tsx without validating its URL scheme. An authenticated organization member or environment API-key holder can store a javascript: redirect with target _self in an in-app workflow. When a recipient using a Chromium-based browser clicks the notification, window.open executes the redirect in the current inbox-hosting origin, which can expose session material and permit authenticated actions in a customer application or the self-hosted Novu dashboard. This issue is fixed in version 3.18.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-75510 https://db.gcve.eu/vuln/ghsa-8gr3-5j6f-25gp <p><strong>Affected:</strong> npm: @novu/js</p> <p>## Summary</p> <p>The `@novu/js` In-App Inbox renderer passes a notification&#39;s `redirect.url` to `window.open()` with no URL-scheme validation. The value originates from a notification&#39;s call-to-action and is delivered to the recipient verbatim.</p> <p>An authenticated organization member (or any holder of the environment API key) creates a v1 in-app workflow whose step CTA stores `cta.data = { url: &#34;javascript:&lt;payload&gt;&#34;, target: &#34;_self&#34; }`. The v1 message-template `cta.data` field is a Mongoose `Mixed` type, so the arbitrary `target` key is accepted and persisted. The server-side inbox mapper copies `cta.data.url` and `cta.data.target` into the notification&#39;s `redirect` object with no scheme check. Novu&#39;s v2 control schema validates redirect URLs against `redirectUrlRegex` (which rejects `javascript:`), proving the intended invariant; the v1 path and the client renderer do not enforce it.</p> <p>When the recipient clicks the notification, the inbox calls `window.open(url, &#34;_self&#34;, &#34;noopener noreferrer&#34;)`. In Chromium browsers a `javascript:` URL opened with `target=&#34;_self&#34;` executes in the current document origin (the default `_blank` is browser-blocked, so the attacker sets `_self`).</p> <p>Result: a low-privilege content author runs arbitrary JavaScript in the browser of every recipient who clicks, in the origin that hosts the inbox (the customer application or the self-hosted Novu dashboard, neither of which sends a CSP).</p> <p>## Affected</p> <p>novuhq/novu self-hosted and cloud, API &lt;= v3.15.0; `@novu/…</p> <p><strong>Affected:</strong> npm: @novu/js</p> <p>## Summary</p> <p>The `@novu/js` In-App Inbox renderer passes a notification&#39;s `redirect.url` to `window.open()` with no URL-scheme validation. The value originates from a notification&#39;s call-to-action and is delivered to the recipient verbatim.</p> <p>An authenticated organization member (or any holder of the environment API key) creates a v1 in-app workflow whose step CTA stores `cta.data = { url: &#34;javascript:&lt;payload&gt;&#34;, target: &#34;_self&#34; }`. The v1 message-template `cta.data` field is a Mongoose `Mixed` type, so the arbitrary `target` key is accepted and persisted. The server-side inbox mapper copies `cta.data.url` and `cta.data.target` into the notification&#39;s `redirect` object with no scheme check. Novu&#39;s v2 control schema validates redirect URLs against `redirectUrlRegex` (which rejects `javascript:`), proving the intended invariant; the v1 path and the client renderer do not enforce it.</p> <p>When the recipient clicks the notification, the inbox calls `window.open(url, &#34;_self&#34;, &#34;noopener noreferrer&#34;)`. In Chromium browsers a `javascript:` URL opened with `target=&#34;_self&#34;` executes in the current document origin (the default `_blank` is browser-blocked, so the attacker sets `_self`).</p> <p>Result: a low-privilege content author runs arbitrary JavaScript in the browser of every recipient who clicks, in the origin that hosts the inbox (the customer application or the self-hosted Novu dashboard, neither of which sends a CSP).</p> <p>## Affected</p> <p>novuhq/novu self-hosted and cloud, API &lt;= v3.15.0; `@novu/…</p> https://db.gcve.eu/vuln/ghsa-8gr3-5j6f-25gp