AIKIDO-2026-880038

TL;DR

The In-App Inbox renderer in @novu/js passes a notification redirect.url to window.open() without validating the URL scheme. A call-to-action stored through the v1 in-app workflow path can carry a javascript: URL together with a _self target, which the server maps into the notification redirect object and returns to recipients unchanged. When a recipient clicks the notification in a Chromium browser, the javascript: URL runs as stored cross-site scripting in the document origin hosting the inbox, allowing theft of session tokens and authenticated actions in that origin. The fix validates redirect URLs and targets in both the inbox API mapper and the client renderer so unsafe schemes and targets are rejected.