Description
The @novu/js In-App Inbox renderer passes a notification’s redirect.url to window.open() with no URL-scheme validation. The value originates from a notification’s call-to-action and is delivered to the recipient verbatim.
Recommendation
Update the @novu/js package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.17.0
- Patched version(s): 3.18.0
References
Could your website be exposed too?
SmartScanner can check your website for Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme and gives you actionable findings to investigate.
Start a free scanRelated Issues
- i18nextify has DOM XSS via javascript:/data: URL schemes in translated href/src attributes - CVE-2026-41692
- HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft - CVE-2026-46496
- TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover - @tinacms/app - CVE-2026-55660
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - @tinacms/mdx - CVE-2026-55661
You might also like:
See something that needs correcting? Let us knowUpdated September 22, 2026