{"id":"EUVD-2026-64042","enisaUuid":"e03f27e2-eb95-368e-8ef4-3cac6f2207c9","description":"Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3.","datePublished":"Aug 21, 2026, 6:21:46 PM","dateUpdated":"Aug 21, 2026, 9:43:35 PM","baseScore":4.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","references":"https://github.com/Unleash/unleash/security/advisories/GHSA-w4mq-xh27-6xpx\nhttps://github.com/Unleash/unleash/commit/002012cfdbedd2e9b7db9dc83b9f549f761db22e\nhttps://github.com/Unleash/unleash/releases/tag/v8.0.3\n","aliases":"CVE-2026-63466\nGHSA-w4mq-xh27-6xpx\n","assigner":"GitHub_M","epss":0.32,"enisaIdProduct":[{"id":"a7a98940-0f6d-3c67-bd53-0147585c3613","product":{"name":"unleash","vendor":{"name":"Unleash"}},"product_version":"\u003c 8.0.3"}],"enisaIdVendor":[{"id":"38151892-a722-301e-b6a1-40e0106d6a68","vendor":{"name":"Unleash"}}],"enisaIdVulnerability":[{"id":"2eaef3a0-77a4-30ed-aa3a-a5104ac36477","vulnerability":{"id":"CVE-2026-63466","description":"Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3.","datePublished":"Aug 21, 2026, 6:21:46 PM","dateUpdated":"Aug 21, 2026, 9:43:35 PM","status":"PUBLISHED","baseScore":4.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","references":"https://github.com/Unleash/unleash/security/advisories/GHSA-w4mq-xh27-6xpx\nhttps://github.com/Unleash/unleash/commit/002012cfdbedd2e9b7db9dc83b9f549f761db22e\nhttps://github.com/Unleash/unleash/releases/tag/v8.0.3\n","enisa_id":"EUVD-2026-64042\n","assigner":"GitHub_M","epss":0.32,"dataProcessed":"Nov 9, 2026, 3:06:27 PM","vulnerabilityProduct":[{"id":"857c64ed-42c3-38e5-820a-091c76cafd00","product":{"name":"unleash","vendor":{"name":"Unleash"}},"product_version":"\u003c 8.0.3"}],"vulnerabilityVendor":[{"id":"5b96513a-931c-3e24-9aef-f3b9880d7590","vendor":{"name":"Unleash"}}]}},{"id":"4ce10a6f-7178-3636-942e-5cc888aab0ba","vulnerability":{"id":"GHSA-w4mq-xh27-6xpx","description":"Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username","datePublished":"Aug 21, 2026, 7:14:52 PM","dateUpdated":"Aug 21, 2026, 7:14:52 PM","baseScore":0.0,"references":"https://github.com/Unleash/unleash/security/advisories/GHSA-w4mq-xh27-6xpx\nhttps://github.com/Unleash/unleash/commit/002012cfdbedd2e9b7db9dc83b9f549f761db22e\nhttps://github.com/Unleash/unleash\nhttps://github.com/Unleash/unleash/releases/tag/v8.0.3\n","enisa_id":"EUVD-2026-64042\n","aliases":"GHSA-w4mq-xh27-6xpx\nCVE-2026-63466\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:51:44 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}