CVE-2026-76909

Received Received - Intake

Stored XSS in Unleash Feature Management Platform

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description

Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML escaping, and sendRequestedCRApprovalEmail passes those values to Mustache rendering. A project member who can create a change request when approval emails are enabled can inject HTML into an approver's notification, allowing forged links, tracking content, or visually altered email content. This issue is fixed in version 8.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-76909

EUVD

EUVD-2026-84824

Affected Vendors & Products

Vendor	Product	Version / Range
unleash	unleash	8.0.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability affects Unleash, an open-source feature management platform. Before version 8.0.3, an email template used for change request approvals did not properly escape user-controlled input like change request titles, requester names, and requester emails. This allowed HTML injection into approval emails, which could be used to forge links, include tracking content, or alter the visual appearance of the email.

Detection Guidance

This vulnerability involves HTML injection in email templates due to improper escaping of user-controlled fields. To detect it, inspect the Unleash application version and check if it is below 8.0.3. Review email templates for change requests and verify if user inputs like changeRequestTitle, requesterName, and requesterEmail are properly escaped.

Impact Analysis

If you are a project member who can create change requests with approval emails enabled, an attacker could exploit this to inject malicious HTML into emails sent to approvers. This could trick approvers into clicking forged links, disclose sensitive information through tracking, or manipulate the email content to appear legitimate while hiding malicious intent.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling email-based phishing or social engineering attacks. HTML injection in approval emails may allow attackers to forge links or alter email content, which could trick recipients into disclosing sensitive information or granting unauthorized access. This undermines data protection and integrity requirements under these regulations.

Mitigation Strategies

Upgrade Unleash to version 8.0.3 or later to fix the vulnerability. If upgrading is not immediately possible, disable email notifications for change requests or restrict project member permissions to prevent unauthorized change request creation.

Hi! I’m here to help you understand CVE-2026-76909. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70