Read the docs
TI-2026-53732 Aliases CVE-2026-76909GHSA-7hvx-28gp-mf6j

Unleash: CR-approval email renders user-controlled raw HTML

Priority LOW 12CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML escaping, and sendRequestedCRApprovalEmail passes those values to Mustache rendering. A project member who can create a change request when approval emails are enabled can inject HTML into an approver's notification, allowing forged links, tracking content, or visually altered email content. This issue is fixed in version 8.0.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00467 40th percentileScored 2026-11-07
Fix Fixed unleash (Unleash): 8.0.3unleash-server (npm): 8.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Unleashunleashbefore 8.0.38.0.3Patch availableCNA
—unleash-server (npm)before 8.0.38.0.3Patch availableGHSA-7hvx-28gp-mf6j
  • unleash VendorUnleash Affected before 8.0.3 Fixed in 8.0.3 Patch available CNA
  • unleash-server (npm) Vendor— Affected before 8.0.3 Fixed in 8.0.3 Patch available GHSA-7hvx-28gp-mf6j

Remediation

  • Fix · CNA unleash (Unleash) Fixed in 8.0.3
  • Fix · GHSA-7hvx-28gp-mf6j unleash-server (npm) Fixed in 8.0.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76909
  2. 2026-10-03 Alias added: GHSA-7hvx-28gp-mf6j

References

Other 4

  • TI-2026-45230 Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter CVSS 3.1HIGH 7.5
  • TI-2026-45005 Server-side request forgery in unleash CVSS 3.1MEDIUM 5.5
  • TI-2026-53733 Unleash: Clone-feature lets a user copy a feature from a project they cannot read CVSS 4.0MEDIUM 5.3
  • TI-2026-54010 Authorization bypass in unleash CVSS 3.1MEDIUM 4.3
  • TI-2026-54011 Unleash: Missing await on permission check + cross-project IDOR in admin API CVSS 4.0HIGH 7.1
  • TI-2026-45232 Improper output encoding in unleash CVSS 3.1MEDIUM 4.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences