Read the docs
TI-2026-45232 Aliases CVE-2026-63466GHSA-w4mq-xh27-6xpx

Improper output encoding in unleash

Priority LOW 19CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00319 25th percentileScored 2026-11-07
Fix Fixed unleash (Unleash): 8.0.3unleash-server (npm): 8.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Unleashunleashbefore 8.0.38.0.3Patch availableCNA
—unleash-server (npm)before 8.0.38.0.3Patch availableGHSA-w4mq-xh27-6xpx
  • unleash VendorUnleash Affected before 8.0.3 Fixed in 8.0.3 Patch available CNA
  • unleash-server (npm) Vendor— Affected before 8.0.3 Fixed in 8.0.3 Patch available GHSA-w4mq-xh27-6xpx

Remediation

  • Fix · CNA unleash (Unleash) Fixed in 8.0.3
  • Fix · GHSA-w4mq-xh27-6xpx unleash-server (npm) Fixed in 8.0.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63466
  2. 2026-10-03 Alias added: GHSA-w4mq-xh27-6xpx

References

Other 4

  • TI-2026-45230 Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter CVSS 3.1HIGH 7.5
  • TI-2026-45005 Server-side request forgery in unleash CVSS 3.1MEDIUM 5.5
  • TI-2026-53733 Unleash: Clone-feature lets a user copy a feature from a project they cannot read CVSS 4.0MEDIUM 5.3
  • TI-2026-54010 Authorization bypass in unleash CVSS 3.1MEDIUM 4.3
  • TI-2026-54011 Unleash: Missing await on permission check + cross-project IDOR in admin API CVSS 4.0HIGH 7.1
  • TI-2026-53732 Unleash: CR-approval email renders user-controlled raw HTML CVSS 4.0LOW 2.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences