{"id":"CVE-2026-63466","title":"Unleash is an open-source feature management platform","summary":"Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templa…","severity":"medium","cvss":4.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","cwe":["CWE-116"],"vendor":"unleash-server","product":"unleash-server","affected":["unleash-server < 8.0.3"],"patched":["unleash-server 8.0.3"],"published":"2026-08-21","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:20:38.860","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63466","references":[{"url":"https://github.com/Unleash/unleash/commit/002012cfdbedd2e9b7db9dc83b9f549f761db22e","label":"security-advisories@github.com"},{"url":"https://github.com/Unleash/unleash/releases/tag/v8.0.3","label":"security-advisories@github.com"},{"url":"https://github.com/Unleash/unleash/security/advisories/GHSA-w4mq-xh27-6xpx","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-w4mq-xh27-6xpx"}],"tags":["nvd","ghsa","npm"],"epss":0.00319,"epssPercentile":0.22143,"aliases":["GHSA-w4mq-xh27-6xpx"],"ecosystem":"npm","ingestedAt":"2026-08-21T19:21:05.329Z","slug":"CVE-2026-63466","body":"## Overview\n\nUnleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-63466)\n\nAffected packages:\n\n- `unleash-server < 8.0.3`\n\nPatched in:\n\n- `unleash-server 8.0.3`\n\nSource: https://github.com/advisories/GHSA-w4mq-xh27-6xpx","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":22.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}