{"id":"CVE-2026-63466","sourceIdentifier":"security-advisories@github.com","published":"2026-08-21T19:17:32.117","lastModified":"2026-10-14T19:10:00.297","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3."},{"lang":"es","value":"Unleash es una plataforma de gestión de características de código abierto. Antes de la versión 8.0.3, FeatureEventFormatterMd.format en src/lib/addons/feature-event-formatter-md.ts asigna Mustache.escape a una función identidad antes de renderizar las plantillas de acción y ruta. Debido a que Mustache.escape es de ámbito de proceso, la asignación deshabilita el escapado para las llamadas posteriores de Mustache.render en email-service.ts, webhook.ts, datadog.ts y new-relic.ts. Un usuario con nivel de editor puede colocar sintaxis de enlace de Slack o Microsoft Teams en un nombre de usuario sin restricciones, activar un evento de característica e inyectar un enlace etiquetado por el atacante en un canal de notificación saliente de confianza, mientras que otros sumideros de Mustache permanecen sin escapado hasta el reinicio. Este problema está solucionado en la versión 8.0.3."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"Unleash","product":"unleash","versions":[{"version":"< 8.0.3","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-21T20:58:22.218056Z","id":"CVE-2026-63466","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-116"}]}],"references":[{"url":"https://github.com/Unleash/unleash/commit/002012cfdbedd2e9b7db9dc83b9f549f761db22e","source":"security-advisories@github.com"},{"url":"https://github.com/Unleash/unleash/releases/tag/v8.0.3","source":"security-advisories@github.com"},{"url":"https://github.com/Unleash/unleash/security/advisories/GHSA-w4mq-xh27-6xpx","source":"security-advisories@github.com"}]}