CVE-2026-63466

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63466", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-16T21:37:45.768Z", "datePublished": "2026-08-21T18:21:46.526Z", "dateUpdated": "2026-08-21T21:43:35.526Z"}, "containers": {"cna": {"title": "Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username", "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Unleash/unleash/security/advisories/GHSA-w4mq-xh27-6xpx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Unleash/unleash/security/advisories/GHSA-w4mq-xh27-6xpx"}, {"name": "https://github.com/Unleash/unleash/commit/002012cfdbedd2e9b7db9dc83b9f549f761db22e", "tags": ["x_refsource_MISC"], "url": "https://github.com/Unleash/unleash/commit/002012cfdbedd2e9b7db9dc83b9f549f761db22e"}, {"name": "https://github.com/Unleash/unleash/releases/tag/v8.0.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/Unleash/unleash/releases/tag/v8.0.3"}], "affected": [{"vendor": "Unleash", "product": "unleash", "versions": [{"version": "< 8.0.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T18:21:46.526Z"}, "descriptions": [{"lang": "en", "value": "Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3."}], "source": {"advisory": "GHSA-w4mq-xh27-6xpx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T20:58:22.218056Z", "id": "CVE-2026-63466", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T21:43:35.526Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63466", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T20:58:22.218056Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T20:58:23.502Z"}}], "cna": {"title": "Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username", "source": {"advisory": "GHSA-w4mq-xh27-6xpx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Unleash", "product": "unleash", "versions": [{"status": "affected", "version": "< 8.0.3"}]}], "references": [{"url": "https://github.com/Unleash/unleash/security/advisories/GHSA-w4mq-xh27-6xpx", "name": "https://github.com/Unleash/unleash/security/advisories/GHSA-w4mq-xh27-6xpx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Unleash/unleash/commit/002012cfdbedd2e9b7db9dc83b9f549f761db22e", "name": "https://github.com/Unleash/unleash/commit/002012cfdbedd2e9b7db9dc83b9f549f761db22e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/Unleash/unleash/releases/tag/v8.0.3", "name": "https://github.com/Unleash/unleash/releases/tag/v8.0.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T18:21:46.526Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63466", "state": "PUBLISHED", "dateUpdated": "2026-08-21T21:43:35.526Z", "dateReserved": "2026-07-16T21:37:45.768Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-21T18:21:46.526Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "unleash", "vendor": "Unleash", "versions": [{"status": "affected", "version": "< 8.0.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3."}, {"lang": "es", "value": "Unleash es una plataforma de gesti\u00f3n de caracter\u00edsticas de c\u00f3digo abierto. Antes de la versi\u00f3n 8.0.3, FeatureEventFormatterMd.format en src/lib/addons/feature-event-formatter-md.ts asigna Mustache.escape a una funci\u00f3n identidad antes de renderizar las plantillas de acci\u00f3n y ruta. Debido a que Mustache.escape es de \u00e1mbito de proceso, la asignaci\u00f3n deshabilita el escapado para las llamadas posteriores de Mustache.render en email-service.ts, webhook.ts, datadog.ts y new-relic.ts. Un usuario con nivel de editor puede colocar sintaxis de enlace de Slack o Microsoft Teams en un nombre de usuario sin restricciones, activar un evento de caracter\u00edstica e inyectar un enlace etiquetado por el atacante en un canal de notificaci\u00f3n saliente de confianza, mientras que otros sumideros de Mustache permanecen sin escapado hasta el reinicio. Este problema est\u00e1 solucionado en la versi\u00f3n 8.0.3."}], "id": "CVE-2026-63466", "lastModified": "2026-10-14T19:10:00.297", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63466", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T20:58:22.218056Z", "version": "2.0.3"}}]}, "published": "2026-08-21T19:17:32.117", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/commit/002012cfdbedd2e9b7db9dc83b9f549f761db22e"}, {"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/releases/tag/v8.0.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/Unleash/unleash/security/advisories/GHSA-w4mq-xh27-6xpx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,8.0.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "unleash", "source": "cna", "vendor": "Unleash"}, "product": "unleash", "vendor": "unleash"}], "created": "2026-08-21T20:00:13.885712+00:00", "updated": "2026-08-21T21:15:03.267646+00:00", "vendors": ["unleash", "unleash$PRODUCT$unleash"]}