Novu’s In‑App Inbox and React component allow malicious javascript: URLs to be stored in a notification’s call‑to‑action redirect.url field without verifying the URL scheme. An authenticated organization member or API‑key holder can embed a javascript: link that points to target _self. When a user in a Chromium‑based browser clicks the notification, the code runs in the inbox‑hosting origin, enabling the attacker to read session tokens or perform authenticated actions in the customer’s application or self‑hosted Novu dashboard.

Novu (novuhq:novu) versions older than 3.18.0, specifically the @novu/js In‑App Inbox and the @novu/react Inbox component libraries that process notification call‑to‑action URLs.

The vulnerability is a stored cross‑site scripting flaw that requires the attacker to create a malicious notification and rely on a user’s interaction with the In‑App Inbox. The CVSS score of 5.1 indicates medium severity, no EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit is user‑dependent and the code runs in the current origin, the risk is moderate but could result in session hijacking or unauthorized actions against the victim’s account.