p PatchFirst

PatchFirst · Latest vulnerabilities

novu/api vulnerabilities

Vulnerabilities published for novu/api in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. GHSA-26wg-9xf2-q495

    High · CVSS 8.1Fix available

    Novu has a XSS sanitization bypass

    ### Summary XSS sanitization is incomplete, some attributes are missing such as `oncontentvisibilityautostatechange=`. This allows for the email preview to render HTML that executes arbitrary JavaScript, ### Details Sanitization is implemented here: https://github.com/novuhq/novu/blob/next/libs/application-generic/src/services/sanitize/sanitizer.service.ts With `allowedAttributes: false`, all attributes are allowed through `sanitize-html`. Even dangerous ones like `oncontentvisibilityautostatechange=`. The `DANGEROUS_ATTRIBUTES` array tries to handle this by denying more attributes after the fact, but this list is incomplete. I copied all

    novu/apiNode.js
    • Update to 3.15.0
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →