CVE-2026-63466
Received Received - Intake

Feature Event Formatter Markdown Template Injection in Unleash

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-63466
EUVD
EUVD-2026-64042

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
unleash unleash to 8.0.3 (exc)
unleash unleash 8.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Unleash (before version 8.0.3) involves a flaw where FeatureEventFormatterMd.format assigns Mustache.escape to an identity function, disabling HTML escaping globally. This allows attackers with Editor-level access to inject malicious links into notifications by setting a username with Slack or Teams link syntax. The issue affects multiple integrations like Slack, Teams, Webhook, Datadog, and New Relic.

Detection Guidance

Check Unleash server version with: curl -s http://<unleash-server>/api/client/features | grep version. If version is <= 8.0.1, the system is vulnerable. Inspect logs for feature events triggering notifications to Slack, Teams, or other integrations.

Impact Analysis

An attacker could exploit this to inject malicious links into trusted outbound notifications, potentially tricking users into clicking harmful links. This could lead to phishing attacks, unauthorized access, or other security breaches. The impact is limited to notifications and requires only Editor-level access to exploit.

Compliance Impact

This vulnerability could lead to data breaches by enabling phishing attacks, which may violate GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations using Unleash versions before 8.0.3 may face compliance risks due to potential unauthorized access or data leaks through notification channels.

Mitigation Strategies

Upgrade Unleash to version 8.0.3 or later immediately. Restart the Unleash server to clear any polluted Mustache state. Review user permissions to ensure only trusted users have Editor-level access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63466. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart