Junglewise Threat Intelligence

CVE-2026-63466: Unleash global Mustache.escape override disables HTML escaping in notifications

CVE-2026-63466 · Severity: medium · CVSS 4.1 · Published 2026-08-21

Executive brief

Unleash, a feature flag management platform, has a vulnerability in its notification system that disables HTML escaping process-wide when certain notification integrations (Slack, Teams, Webhooks, Datadog, New Relic) format events. An attacker with an Editor role can set a malicious username containing link-injection syntax, which then appears unescaped in outbound notifications to these platforms, enabling phishing attacks via clickable malicious links injected into trusted notification feeds.

Technical details

The vulnerability lies in `FeatureEventFormatterMd.format()` (src/lib/addons/feature-event-formatter-md.ts:355), which globally mutates `Mustache.escape = (text) => text;` to disable HTML escaping during template rendering. Since Mustache's `escape` function is a module-level singleton shared across the entire Node.js process, this single assignment permanently disables escaping for all downstream `Mustache.render()` calls in email-service, webhook, Datadog, and New Relic formatters until process restart. The attack vector requires an attacker-controlled username field (event.createdBy) to be interpolated into event templates via single-mustache syntax `{{user}}`. Usernames lack validation and can contain characters like `<`, `>`, and `|` that Slack/Teams use for link injection syntax (`<url|label>`). An Editor-level account holder (or self-registered user if public signup is enabled) can perform routine actions (toggle a flag), triggering event formatting that renders the malicious username unescaped into notification payloads sent to Slack, Teams, or custom webhooks. The fix is to pass an escape function via per-call render options (`RenderOptions.escape`) rather than mutating the global singleton. Fixed in version 8.0.3.

Affected products

  • Unleash unleash-server < 8.0.3

Timeline

  • 2026-08-21: disclosed: Published in GitHub Advisory Database
  • 2026-08-21: patched: Fixed in v8.0.3

References