EUVD-2026-64042
GHSA-w4mq-xh27-6xpx
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Editor-level authentication required (PR:L), victim must actively click injected link (UI:R), scope crosses to external notification channels (S:C), no confidentiality or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3.
AnalysisAI
Process-wide Mustache HTML escaping is permanently disabled in Unleash (all versions prior to 8.0.3) from the first moment any notification addon formats a feature event, allowing an editor-level user who has placed Slack or Teams link syntax in their unrestricted username to inject attacker-controlled hyperlinks into every configured outbound notification channel - including Slack, Microsoft Teams, Datadog, New Relic, and email. The scope change (S:C in CVSS) reflects that the vulnerable assignment in FeatureEventFormatterMd contaminates Mustache rendering across email-service.ts, webhook.ts, datadog.ts, and new-relic.ts for the lifetime of the Node.js process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Unleash account with at minimum editor-level privileges (CVSS PR:L; not unauthenticated). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.1 score and vector (AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) accurately characterize the realistic threat profile: network-reachable but requiring editor-level authentication (PR:L), dependent on a victim clicking an injected link (UI:R), with limited integrity impact (I:L) scoped across component boundaries to notification channels (S:C). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Unleash 8.0.3 or later, available at https://github.com/Unleash/unleash/releases/tag/v8.0.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Stack exhaustion denial-of-service in Unleash's OpenAPI validation middleware allows unauthenticated network attackers t
Server-Side Request Forgery in Unleash's addon and integration subsystem (versions prior to 7.5.2, 7.6.5, and 8.0.2) all
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today