Executive brief
Unleash, a feature flag management platform, has a vulnerability in its notification system that disables HTML escaping process-wide when certain notification integrations (Slack, Teams, Webhooks, Datadog, New Relic) format events. An attacker with an Editor role can set a malicious username containing link-injection syntax, which then appears unescaped in outbound notifications to these platforms, enabling phishing attacks via clickable malicious links injected into trusted notification feeds.
Technical details
The vulnerability lies in `FeatureEventFormatterMd.format()` (src/lib/addons/feature-event-formatter-md.ts:355), which globally mutates `Mustache.escape = (text) => text;` to disable HTML escaping during template rendering. Since Mustache's `escape` function is a module-level singleton shared across the entire Node.js process, this single assignment permanently disables escaping for all downstream `Mustache.render()` calls in email-service, webhook, Datadog, and New Relic formatters until process restart. The attack vector requires an attacker-controlled username field (event.createdBy) to be interpolated into event templates via single-mustache syntax `{{user}}`. Usernames lack validation and can contain characters like `<`, `>`, and `|` that Slack/Teams use for link injection syntax (`<url|label>`). An Editor-level account holder (or self-registered user if public signup is enabled) can perform routine actions (toggle a flag), triggering event formatting that renders the malicious username unescaped into notification payloads sent to Slack, Teams, or custom webhooks. The fix is to pass an escape function via per-call render options (`RenderOptions.escape`) rather than mutating the global singleton. Fixed in version 8.0.3.
Affected products
- Unleash unleash-server < 8.0.3
Timeline
- 2026-08-21: disclosed: Published in GitHub Advisory Database
- 2026-08-21: patched: Fixed in v8.0.3
References
- https://api.github.com/users/iaohkut-from-NightWolf-Team
- https://github.com/iaohkut-from-NightWolf-Team
- https://api.github.com/users/iaohkut-from-NightWolf-Team/gists%7B/gist_id%7D
- https://api.github.com/users/iaohkut-from-NightWolf-Team/repos
- https://avatars.githubusercontent.com/u/286391906?v=4
- https://api.github.com/users/iaohkut-from-NightWolf-Team/events%7B/privacy%7D