Unleash
Monthly
Process-wide Mustache HTML escaping is permanently disabled in Unleash (all versions prior to 8.0.3) from the first moment any notification addon formats a feature event, allowing an editor-level user who has placed Slack or Teams link syntax in their unrestricted username to inject attacker-controlled hyperlinks into every configured outbound notification channel - including Slack, Microsoft Teams, Datadog, New Relic, and email. The scope change (S:C in CVSS) reflects that the vulnerable assignment in FeatureEventFormatterMd contaminates Mustache rendering across email-service.ts, webhook.ts, datadog.ts, and new-relic.ts for the lifetime of the Node.js process. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Stack exhaustion denial-of-service in Unleash's OpenAPI validation middleware allows unauthenticated network attackers to terminate the Node.js server process by submitting a roughly 10 KB JSON payload nested thousands of levels deep to any OpenAPI-validated endpoint. Versions prior to 7.5.2, 7.6.5, and 8.0.2 are affected; the shared error-formatting path in src/lib/error/bad-data-error.ts calls JSON.stringify on raw request values without catching the resulting RangeError, which propagates uncaught and kills the process. No public exploit code has been identified at time of analysis, though the attack is trivially reproducible from the advisory description alone, and replaying the request sustains the outage indefinitely.
Server-Side Request Forgery in Unleash's addon and integration subsystem (versions prior to 7.5.2, 7.6.5, and 8.0.2) allows authenticated operators with CREATE_ADDON or UPDATE_ADDON permissions to cause the Unleash server to issue HTTP requests to arbitrary internal network addresses, including loopback, link-local, and cloud metadata endpoints such as the AWS Instance Metadata Service. The vulnerability exists because operator-supplied URL parameters in Webhook, Slack, Microsoft Teams, Datadog, and New Relic integration configurations were passed directly to the internal fetch function without SSRF filtering, enabling blind network probing via event status responses and credential forwarding when Authorization or API key headers are configured. Vendor-released patches are available and no public exploit code has been identified at time of analysis.
Process-wide Mustache HTML escaping is permanently disabled in Unleash (all versions prior to 8.0.3) from the first moment any notification addon formats a feature event, allowing an editor-level user who has placed Slack or Teams link syntax in their unrestricted username to inject attacker-controlled hyperlinks into every configured outbound notification channel - including Slack, Microsoft Teams, Datadog, New Relic, and email. The scope change (S:C in CVSS) reflects that the vulnerable assignment in FeatureEventFormatterMd contaminates Mustache rendering across email-service.ts, webhook.ts, datadog.ts, and new-relic.ts for the lifetime of the Node.js process. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Stack exhaustion denial-of-service in Unleash's OpenAPI validation middleware allows unauthenticated network attackers to terminate the Node.js server process by submitting a roughly 10 KB JSON payload nested thousands of levels deep to any OpenAPI-validated endpoint. Versions prior to 7.5.2, 7.6.5, and 8.0.2 are affected; the shared error-formatting path in src/lib/error/bad-data-error.ts calls JSON.stringify on raw request values without catching the resulting RangeError, which propagates uncaught and kills the process. No public exploit code has been identified at time of analysis, though the attack is trivially reproducible from the advisory description alone, and replaying the request sustains the outage indefinitely.
Server-Side Request Forgery in Unleash's addon and integration subsystem (versions prior to 7.5.2, 7.6.5, and 8.0.2) allows authenticated operators with CREATE_ADDON or UPDATE_ADDON permissions to cause the Unleash server to issue HTTP requests to arbitrary internal network addresses, including loopback, link-local, and cloud metadata endpoints such as the AWS Instance Metadata Service. The vulnerability exists because operator-supplied URL parameters in Webhook, Slack, Microsoft Teams, Datadog, and New Relic integration configurations were passed directly to the internal fetch function without SSRF filtering, enabling blind network probing via event status responses and credential forwarding when Authorization or API key headers are configured. Vendor-released patches are available and no public exploit code has been identified at time of analysis.