Skip to content
OpenAdvisories

Package · npm

@novu/js

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.1
    CVE-2026-75510

    Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme

    Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through apps/…

    novuhq novu @novu/js npm