Unleash CVE-2026-63466

Exploitation requires an authenticated Unleash account with at minimum editor-level privileges (CVSS PR:L; not unauthenticated). The attacker must be able to set their username or display name to arbitrary string content containing Slack mrkdwn or Teams link syntax (<url|label> or equivalent) - this is possible because the username and name fields are validated only with a Joi string type check and have no character set restrictions. At least one outbound notification addon must be configured and active: Webhook, Slack (legacy), Microsoft Teams, Datadog, or New Relic integrations are all affected sinks. The injection activates the first time any feature flag event causes FeatureEventFormatterMd.format() to execute (whether triggered by the attacker or normal platform activity) and persists for the remaining lifetime of the Node.js process. Exploitation is limited by: requirement for editor-level authentication; requirement that at least one notification integration is configured (Unleash instances with no addons configured are not exposed to the cross-channel contamination); and requirement that victims actively click the injected link for harm beyond link appearance in a notification. Deployments running Unleash 8.0.3 or later are not affected.

The CVSS 4.1 score and vector (AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) accurately characterize the realistic threat profile: network-reachable but requiring editor-level authentication (PR:L), dependent on a victim clicking an injected link (UI:R), with limited integrity impact (I:L) scoped across component boundaries to notification channels (S:C). No EPSS score was provided in the input data, so probabilistic exploitation frequency cannot be assessed quantitatively. The absence of a KEV listing and the lack of public POC code keep this in the monitored-but-not-emergency tier for most organizations. The primary real-world risk is trust abuse: organizations using Unleash webhook or chat integrations as a trusted feed for deployment or incident response decisions are exposed to phishing via an attacker-controlled link rendered in what appears to be a legitimate Unleash system notification. The process-wide persistence of the escaping bypass - active from the first notification event until process restart - amplifies impact beyond the initial trigger. The attack surface is bounded by: the requirement for editor-level credentials, the need for at least one notification addon to be configured, and the need for victim interaction to realize downstream harm beyond link appearance.

An attacker who holds or obtains an Unleash editor-level account sets their display name to a Slack mrkdwn link string such as <https://attacker.example.com|URGENT: prod incident - click here>. On the next feature flag event (toggled by the attacker or any other user), FeatureEventFormatterMd.format() fires, permanently disables Mustache HTML escaping for the process, and the username renders unescaped into every configured notification channel; recipients in Slack, Teams, or Datadog see a legitimate Unleash system message containing a hyperlink pointing to an attacker-controlled destination. No public exploit code has been identified, but the attack requires no specialized tooling beyond a text field and an editor account.