CVE-2026-63466mediumCWE-116

CVE-2026-63466: medium-severity vulnerability in unleash

Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

Published

Follow this CVE+ Monitor unleash+ Monitor unleash-server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.1epss 0.3%
Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Affected products
Unleash · unleash
Related CVEs — unleash

In the same product, most dangerous first.

CVE-2026-63462HIGHUnleash: Unauthenticated single-request DoS via OpenAPI validation error formatterEPSS 0.7%CVE-2026-77426HIGHUnleash: Missing await on permission check + cross-project IDOR in admin APIEPSS 0.5%CVE-2026-76909LOWUnleash: CR-approval email renders user-controlled raw HTMLEPSS 0.5%CVE-2026-76910MEDIUMUnleash: Clone-feature lets a user copy a feature from a project they cannot readEPSS 0.4%CVE-2026-63004MEDIUMUnleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headersEPSS 0.4%CVE-2026-77425MEDIUMUnleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit logEPSS 0.3%