---
id: CVE-2026-63466
title: Unleash is an open-source feature management platform
summary: >-
  Unleash is an open-source feature management platform. Prior to 8.0.3,
  FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts
  assigns Mustache.escape to an identity function before rendering action and
  path templa…
severity: medium
cvss: 4.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N'
cwe:
  - CWE-116
vendor: unleash-server
product: unleash-server
affected:
  - unleash-server < 8.0.3
patched:
  - unleash-server 8.0.3
published: '2026-08-21'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:20:38.860'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63466'
references:
  - url: >-
      https://github.com/Unleash/unleash/commit/002012cfdbedd2e9b7db9dc83b9f549f761db22e
    label: security-advisories@github.com
  - url: 'https://github.com/Unleash/unleash/releases/tag/v8.0.3'
    label: security-advisories@github.com
  - url: 'https://github.com/Unleash/unleash/security/advisories/GHSA-w4mq-xh27-6xpx'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-w4mq-xh27-6xpx'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00319
epssPercentile: 0.22235
aliases:
  - GHSA-w4mq-xh27-6xpx
ecosystem: npm
ingestedAt: '2026-08-21T19:21:05.329Z'
---

## Overview

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-63466)

Affected packages:

- `unleash-server < 8.0.3`

Patched in:

- `unleash-server 8.0.3`

Source: https://github.com/advisories/GHSA-w4mq-xh27-6xpx