Executive brief
Unleash is a feature management and experimentation platform that supports change requests requiring approval from designated reviewers. A vulnerability in the approval notification email template allows users who can create change requests to inject arbitrary HTML into emails sent to approvers. This can be exploited to display forged approval links, redirect approvers to malicious sites, inject tracking pixels, or manipulate email content to deceive recipients.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the change-request approval email template (requested-cr-approval.html.mustache). The template uses Mustache triple-brace syntax ({{{ }}} ) to render user-controlled fields such as changeRequestTitle, requesterName, requesterEmail, and changeRequestLink without HTML escaping. The sendRequestedCRApprovalEmail function in email-service.ts uses Mustache.render to process the template. An attacker with change-request creation privileges can set their display name or the change-request title to contain HTML/JavaScript, which will be rendered raw in approval emails sent to reviewers. No user interaction beyond normal workflow (creating a change request) is required to trigger the vulnerability. The patch is available in version 8.0.3 and later.
Affected products
- Unleash unleash-server < 8.0.3
Timeline
- 2026-07-10: disclosed
- 2026-09-22: advisory
- 2026-09-22: patched: Version 8.0.3 released