CVE-2026-63466: Unleash Feature Management XSS Vulnerability

CVE-2026-63466 Overview

Unleash is an open-source feature management platform. Versions prior to 8.0.3 contain an output-encoding flaw in FeatureEventFormatterMd.format inside src/lib/addons/feature-event-formatter-md.ts. The formatter reassigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for every subsequent Mustache.render call across email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can inject attacker-controlled Slack or Microsoft Teams link syntax through an unrestricted username and deliver it inside trusted outbound notifications. The issue is classified as [CWE-116] Improper Encoding or Escaping of Output.

Critical Impact
Editor-level users can inject arbitrary links into outbound Slack, Teams, email, webhook, Datadog, and New Relic notifications until the Unleash process restarts.

Affected Products

Unleash open-source feature management platform
All versions prior to 8.0.3
Deployments using Slack, Microsoft Teams, email, webhook, Datadog, or New Relic addons

Discovery Timeline

2026-08-21 - CVE-2026-63466 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-63466

Vulnerability Analysis

The defect resides in the Markdown formatter used to build addon notification payloads. Before rendering an event, the formatter assigns Mustache.escape = (text) => text, which is intended to preserve Markdown syntax. Mustache's escape property is module-global rather than per-call, so the reassignment persists for the lifetime of the Node.js process.

Once triggered, other addons that call Mustache.render no longer HTML-escape template variables. An attacker with editor privileges sets a username containing Slack link syntax such as <https://attacker.example|Click here> or Teams-flavored Markdown links. Triggering any feature event causes the unescaped username to be rendered into outbound notifications.

Because the recipients trust the Unleash notification channel, the injected link appears authoritative. The affected sinks include email-service.ts, webhook.ts, datadog.ts, and new-relic.ts, expanding the blast radius beyond the originating addon.

Root Cause

The root cause is process-wide mutation of shared library state. Mustache exposes escape as a module property, and reassigning it inside a request handler leaks the change to every consumer of the library. The formatter should have used a per-render override rather than mutating global state.

Attack Vector

An authenticated editor-level account sets a Slack- or Teams-formatted link inside a username or other unrestricted field. The user then performs an action that emits a feature event, such as toggling a flag. The formatted event is delivered through configured addons, injecting the attacker-labeled link into the trusted channel.

typescript

// Patch from Unleash commit 002012cfdbedd2e9b7db9dc83b9f549f761db22e
// fix: Do not pollute global Mustache state (#1222)
            ...formatting,
        };

-        Mustache.escape = (text) => text;
-
-        const text = Mustache.render(action, context);
+        const renderContext = { escape: (text: string) => text };
+        const text = Mustache.render(action, context, undefined, renderContext);
         const url = path
-            ? `${this.unleashUrl}${Mustache.render(path, context)}`
+            ? `${this.unleashUrl}${Mustache.render(path, context, undefined, renderContext)}`
             : undefined;

        return {

Source: GitHub Commit 002012cfdbedd2e9b7db9dc83b9f549f761db22e. The patch replaces the global Mustache.escape assignment with a per-call renderContext argument, keeping escaping semantics scoped to the formatter.

Detection Methods for CVE-2026-63466

Indicators of Compromise

Outbound Slack or Microsoft Teams messages containing link syntax (<url|label> or [label](url)) rendered from Unleash usernames or feature metadata.
Unleash audit log entries showing editor accounts with usernames containing angle brackets, pipes, or Markdown link characters.
Webhook, Datadog, or New Relic events with unescaped HTML or Markdown after any single feature-event addon delivery.

Detection Strategies

Search Unleash user records for accounts whose display names contain <, >, |, [, or ]( sequences.
Compare outbound addon payload templates against rendered notification content to identify unescaped template output.
Review Slack, Teams, and email gateways for links pointing to external domains delivered via the Unleash integration user.

Monitoring Recommendations

Alert on creation or modification of editor-level users whose usernames include URL or Markdown metacharacters.
Log every Unleash addon delivery and diff rendered output against the source template to catch escape regressions.
Monitor for the presence of external URLs inside notifications originating from internal-only Unleash instances.

How to Mitigate CVE-2026-63466

Immediate Actions Required

Upgrade Unleash to version 8.0.3 or later, which scopes Mustache.escape to each render call.
Rotate or audit editor-level accounts and remove usernames containing link or Markdown metacharacters.
Restart Unleash processes after patching to clear any lingering global escape override from prior runs.

Patch Information

The fix is available in Unleash Release v8.0.3 and detailed in GitHub Security Advisory GHSA-w4mq-xh27-6xpx. The corrective commit is 002012c, which passes an isolated renderContext to Mustache.render rather than mutating global state.

Workarounds

Restrict editor-role assignment until the upgrade to 8.0.3 is complete.
Enforce input validation on username fields to reject Markdown, HTML, and Slack link metacharacters.
Disable non-essential addons (Slack, Teams, email, webhook, Datadog, New Relic) until patching is applied.

bash

# Upgrade Unleash to the patched release
npm install unleash-server@8.0.3
# or, for Docker deployments
docker pull unleashorg/unleash-server:8.0.3
docker restart unleash