Unleash CVE-2026-76909

Exploitation requires all of: (1) the Unleash change-request feature enabled, (2) approval email notifications enabled (the AT:P attack requirement), and (3) an authenticated project member with permission to create change requests (PR:L). The attacker injects raw HTML via the changeRequestTitle, requesterName, or requesterEmail values, which the requested-cr-approval.html.mustache template renders with Mustache triple-stash ({{{ }}}), disabling HTML escaping. Realistic impact is further limited by required approver interaction (an approver must open the email, UI:P) and by the fact that mail clients block script execution, restricting the outcome to HTML content spoofing / forged links rather than code execution. The reporter could not confirm whether the Enterprise deployment runs the vulnerable, unsanitized code path.

This is a genuinely low-priority, low-severity issue and the signals are consistent about that. The vendor CVSS 4.0 base score is 2.1 (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N), reflecting an authenticated attacker (PR:L, must be a project member able to create change requests), an attack requirement (AT:P - the deployment must have change requests and approval emails enabled), and required passive user interaction (UI:P - an approver must open the email). No confidentiality, integrity, or availability impact to the Unleash system itself; only limited subsequent-system integrity/confidentiality (email content manipulation reaching the approver). No EPSS score, KEV listing, POC exploit-code flag, or SSVC decision was provided in the input. There is no code execution: this is HTML injection into an HTML email body, and virtually all mail clients block scripting, so the realistic impact is content spoofing (forged links, tracking pixels, visually altered text) rather than true browser XSS despite the CWE-79 / 'XSS' labeling. The vulnerable component is server-side (npm unleash-server < 8.0.3) and the fix (triple-stash to double-stash Mustache) is confirmed by the vendor commit and the v8.0.3 release. No signals conflict; all point to a real-but-minor phishing/content-forgery risk gated behind authenticated access and a specific feature configuration.

In an Unleash deployment where change requests and approval emails are enabled, a low-privileged project member sets their display name or a change-request title to raw HTML such as </a><a href="https://evil.example">Approve change request</a>, then creates a change request requiring approval. When an approver opens the notification email, the injected markup renders as attacker-controlled links or tracking content, enabling a targeted phishing lure. The GHSA advisory publishes step-by-step reproduction instructions, but no weaponized exploit code and no confirmed active exploitation.