Novu EUVD-2026-84535

Requires an authenticated Novu organization member OR possession of an environment API key to store a 'javascript:'-scheme redirect.url (with target _self) in an in-app workflow call-to-action - this is the concrete precondition (PR:L). Exploitation further requires victim interaction (UI:P): a notification recipient must click the crafted in-app notification, AND the description limits reliable execution to Chromium-based browsers because it depends on how window.open handles the javascript: URI in the inbox-hosting origin. It affects @novu/js In-App Inbox and the @novu/react Inbox component prior to 3.18.0. Limiting factors: not remote-unauthenticated (attacker needs org membership or API key), depends on victim click, and depends on a Chromium browser; self-hosted dashboards and multi-tenant customer apps embedding the Inbox are the higher-risk targets.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/SC:L/SI:L, base 5.1 Medium) tells a consistent story: network-reachable but requiring both low-privilege authentication (PR:L) and victim interaction (UI:P), with only low subsequent-system confidentiality/integrity impact. This is a self/stored client-side script-injection (javascript: URI) flaw, not a directly weaponizable pre-auth RCE. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' The realistic risk is moderate-to-low: an attacker must already hold an organization-member session or an environment API key to plant the malicious call-to-action, and a recipient must then click the notification specifically in a Chromium-based browser (the description notes the window.open behavior is Chromium-specific, which limits reliable cross-browser exploitation). The chief aggravating factor is scope: successful execution runs in the inbox-hosting origin - a customer application or the self-hosted Novu dashboard - allowing session-material exposure and authenticated actions, which is why a scope change is warranted. Overall this is a genuine but conditional stored-XSS-class issue, not a high-urgency mass-exploitation candidate; prioritize patching for multi-tenant/self-hosted dashboard operators over single-tenant deployments.

A low-privileged but authenticated organization member (or anyone holding an environment API key) configures an in-app workflow whose call-to-action redirect.url is a 'javascript:' payload with target _self. When a recipient opens their in-app inbox in a Chromium-based browser and clicks the notification, window.open executes the script in the inbox-hosting origin, exposing session material and enabling authenticated actions in the host application or self-hosted Novu dashboard. No public POC is referenced, though the fixing PR/commit (f105f3d4) and GHSA-8gr3-5j6f-25gp document the vulnerable code path precisely.