Skip to content
OpenAdvisories

Package · npm

@novu/api

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

  • High —
    GHSA-4x48-cgf9-q33f

    Novu has SSRF via conditions filter webhook bypasses validateUrlSsrf() protection

    ## Summary The conditions filter webhook at `libs/application-generic/src/usecases/conditions-filter/conditions-filter.usecase.ts` line 261 sends POST requests to user-configured URLs using raw `axios.post()` with no SSRF validation. The HTTP Request workflow…

    @novu/api npm