Approved changes feed: RSS · Atom
cpe:2.3:a:novu:novu:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Novu (28994c0d-1d2f-5e4b-b817-a5643f56ecee) |
|---|---|
| Product | Novu (8572c405-2f9d-54a8-b7a7-c0125db5c9de) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/novuhq/novu |
purl2cpe | 2026-06-01 10:17:11.072845 |
pkg:npm/novu |
purl2cpe | 2026-06-01 10:17:11.072847 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-35948 |
vulnerable | 2026-06-08 06:06:28.199404 |
Novu Open Redirect Vulnerability in Sign-In with GitHub Functionality
MEDIUM (5.4)
Novu provides an API for sending notifications through multiple channels. Versions prior to 0.16.0 contain an open redirect vulnerability in the "Sign In with GitHub" functionality of Novu's open-source repository. It could have allowed an attacker to force a victim into opening a malicious URL and thus, potentially log into the repository under the victim's account gaining full control of the account. This vulnerability only affected the Novu Cloud and Open-Source deployments if the user manually enabled the GitHub OAuth on their self-hosted instance of Novu. Users should upgrade to version 0.16.0 to receive a patch.
Published: 2023-07-06T14:47:22.310Z
Updated: 2024-10-18T19:16:20.549Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.