CVE-2026-63466: Unleash global Mustache.escape override disables HTML escaping in notifications

CVE-2026-63466 · Severity: medium · CVSS 4.1 · Published 2026-08-21

Unleash, a feature flag management platform, has a vulnerability in its notification system that disables HTML escaping process-wide when certain notification integrations (Slack, Teams, Webhooks, Datadog, New Relic) format events. An attacker with an Editor role can set a malicious username containing link-injection syntax, which then appears unescaped in outbound notifications to these platforms, enabling phishing attacks via clickable malicious links injected into trusted notification feeds.

Technologies: unleash-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-63466 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63466 being exploited in the wild.
How severe is CVE-2026-63466?
Medium severity, with a CVSS score of 4.1, published 21 August 2026.
Which products and versions are affected?
unleash-server (npm) < 8.0.3, SEMVER:introduced=0,fixed=8.0.3.
Is there a fix for CVE-2026-63466?
Yes. unleash-server (npm): upgrade to 8.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63466 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63466?
Check whether you run unleash-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • unleash-server (npm): upgrade to 8.0.3 or later
    npm install unleash-server@8.0.3

Technical details

The vulnerability lies in `FeatureEventFormatterMd.format()` (src/lib/addons/feature-event-formatter-md.ts:355), which globally mutates `Mustache.escape = (text) => text;` to disable HTML escaping during template rendering. Since Mustache's `escape` function is a module-level singleton shared across the entire Node.js process, this single assignment permanently disables escaping for all downstream `Mustache.render()` calls in email-service, webhook, Datadog, and New Relic formatters until process restart. The attack vector requires an attacker-controlled username field (event.createdBy) to be interpolated into event templates via single-mustache syntax `{{user}}`. Usernames lack validation and can contain characters like `&lt;`, `&gt;`, and `|` that Slack/Teams use for link injection syntax (`&lt;url|label&gt;`). An Editor-level account holder (or self-registered user if public signup is enabled) can perform routine actions (toggle a flag), triggering event formatting that renders the malicious username unescaped into notification payloads sent to Slack, Teams, or custom webhooks. The fix is to pass an escape function via per-call render options (`RenderOptions.escape`) rather than mutating the global singleton. Fixed in version 8.0.3.

Affected products

  • Unleash unleash-server < 8.0.3

Identifiers

  • CVE-2026-63466
  • GHSA-w4mq-xh27-6xpx

Timeline

  • 2026-08-21: disclosed: Published in GitHub Advisory Database
  • 2026-08-21: patched: Fixed in v8.0.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.