CVE-2026-63466 in Unleash
Summary
by MITRE • 08/21/2026
Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
Unleash is an open-source platform designed for managing application features through dynamic configuration, allowing organizations to toggle functionality without redeploying code. A critical security vulnerability exists within the FeatureEventFormatterMd component prior to version 8.0.3, specifically in the format method located at src/lib/addons/feature-event-formatter-md.ts. This flaw stems from an improper handling of template escaping mechanisms provided by the Mustache library. The core issue arises when the code assigns a function that acts as an identity function—effectively returning input unchanged—to the global escape property of the Mustache namespace before rendering action and path templates for feature events.
The technical severity of this vulnerability is amplified because the Mustache.escape configuration is process-wide rather than scoped to individual template renders. By overwriting the default escaping behavior with a no-op identity function, the application disables HTML entity encoding for all subsequent calls to Mustache.render within the same Node.js process context. This global state change affects multiple downstream services that rely on this templating engine, including email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. Consequently, any data passed through these templates is rendered without sanitization, leaving them vulnerable to injection attacks until the application server is restarted or the configuration is reset.
The operational impact of this flaw allows an attacker with editor-level permissions in Unleash to perform a Stored Cross-Site Scripting (XSS) attack via outbound notification channels. An attacker can craft a username containing Slack or Microsoft Teams link syntax, which serves as a vector for injecting malicious hyperlinks into trusted communication streams. When the system processes feature events associated with this user profile, the unsanitized input is rendered directly into webhook payloads sent to integrated platforms like Slack or Teams. This results in the delivery of attacker-controlled links that appear legitimate within these trusted environments, potentially leading users to phishing sites or triggering unintended actions upon interaction.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as Cross-site Scripting (XSS). Furthermore, it maps to MITRE ATT&CK technique T1059.007, specifically Command and Scripting Interpretation via JavaScript or HTML injection within application interfaces. The attack vector leverages the trust relationship between the Unleash platform and its integrated notification services, exploiting the lack of output encoding in a shared processing context.
Mitigation for this vulnerability requires immediate upgrading to version 8.0.3 or later, where the code has been corrected to ensure that escaping is applied correctly without disrupting global state for other components. In environments where an upgrade cannot be performed immediately, administrators should restrict editor-level access to trusted individuals only and monitor outbound webhook logs for anomalous link structures. Additionally, implementing strict Content Security Policy headers on any web interfaces exposed by the platform can help mitigate potential client-side exploitation if similar vulnerabilities exist in UI rendering paths.