---
id: CVE-2026-76909
title: Unleash is an open-source feature management platform
summary: >-
  Unleash is an open-source feature management platform. Prior to 8.0.3, the
  change-request approval email template at
  src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache
  renders the user-controlled changeRequestTit…
severity: low
cvss: 2.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'
cwe:
  - CWE-79
vendor: Unleash
product: unleash
affected:
  - unleash < 8.0.3
patched:
  - unleash-server 8.0.3
published: '2026-09-22'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:12:04.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76909'
references:
  - url: >-
      https://github.com/Unleash/unleash/commit/7c89cedcbbb5aa826951373569930e0a3c4358db
    label: security-advisories@github.com
  - url: 'https://github.com/Unleash/unleash/releases/tag/v8.0.3'
    label: security-advisories@github.com
  - url: 'https://github.com/Unleash/unleash/security/advisories/GHSA-7hvx-28gp-mf6j'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-7hvx-28gp-mf6j'
tags:
  - nvd
  - cve.org
  - ghsa
  - npm
epss: 0.00269
epssPercentile: 0.16909
aliases:
  - GHSA-7hvx-28gp-mf6j
ecosystem: npm
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-23T14:10:11.373887Z'
cvssSource: cna
ingestedAt: '2026-09-22T21:11:40.320Z'
---

## Overview

Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML escaping, and sendRequestedCRApprovalEmail passes those values to Mustache rendering. A project member who can create a change request when approval emails are enabled can inject HTML into an approver's notification, allowing forged links, tracking content, or visually altered email content. This issue is fixed in version 8.0.3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-76909)

Affected packages:

- `unleash-server < 8.0.3`

Patched in:

- `unleash-server 8.0.3`

Source: https://github.com/advisories/GHSA-7hvx-28gp-mf6j