CVE-2026-76909: Unleash Feature Management Platform XSS Vulnerability

CVE-2026-76909 Overview

CVE-2026-76909 is an HTML injection vulnerability in Unleash, an open-source feature management platform. Versions prior to 8.0.3 render user-controlled fields in the change-request approval email template without HTML escaping. The affected template src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache interpolates changeRequestTitle, requesterName, and requesterEmail using Mustache triple-brace syntax, which disables escaping. A project member with permission to create change requests can inject HTML into approver notification emails when approval emails are enabled. Injected content can present forged links, embed tracking pixels, or alter the visual appearance of the message. The issue is fixed in Unleash 8.0.3 [CWE-79].

Critical Impact
An authenticated project member can inject HTML into approval notification emails sent to reviewers, enabling social engineering through forged links and altered content.

Affected Products

Unleash feature management platform prior to version 8.0.3
Deployments with change-request approval emails enabled
Any Unleash instance where project members can create change requests

Discovery Timeline

2026-09-22 - CVE-2026-76909 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-76909

Vulnerability Analysis

The vulnerability resides in the Mustache email template used for change-request approval notifications. Mustache treats values inside triple braces ({{{ value }}}) as raw HTML and skips escaping. Values wrapped in double braces ({{ value }}) are HTML-escaped by default.

The template requested-cr-approval.html.mustache used triple braces around changeRequestTitle, requesterName, and requesterEmail. The sendRequestedCRApprovalEmail function passes user-supplied values from change-request creation directly into the template. As a result, HTML tags and attributes supplied by the requester are rendered verbatim in the approver's mailbox.

Because emails are typically viewed in trusted contexts, injected content is well-suited to social engineering. Attackers can substitute the legitimate change-request review link with an attacker-controlled URL, insert tracking beacons, or rewrite the approval prompt.

Root Cause

The root cause is the use of Mustache's unescaped interpolation for user-controlled fields. The template author treated these values as safe HTML, but the values originate from unauthenticated-of-content user input during change-request creation.

Attack Vector

An authenticated project member creates a change request with malicious HTML in the title or with a manipulated profile name or email. When approval emails are enabled, Unleash renders the payload into the notification sent to approvers.

text

         </div>
         <div class="content" style="padding: 20px;text-align: left;">
             <div class="intro" style="margin: 0 4px;">
-                <div style="font-size: 24px;margin: 20px 0;">You have been added to review change request {{{ changeRequestTitle }}} by {{{ requesterName }}} ({{{ requesterEmail }}})</div>
+                <div style="font-size: 24px;margin: 20px 0;">You have been added to review change request {{ changeRequestTitle }} by {{ requesterName }} ({{ requesterEmail }})</div>
                 <div style="font-size: 18px;">Click <a class="changeRequestLink" href="{{{ changeRequestLink }}}" target="_blank" rel="noopener noreferrer">{{{changeRequestLink}}}</a> to review it</div>
             </div>
         </div>

Source: GitHub Commit 7c89ced. The patch replaces triple-brace interpolation with double-brace interpolation for the user-controlled fields, enabling Mustache's default HTML escaping.

Detection Methods for CVE-2026-76909

Indicators of Compromise

Change requests whose changeRequestTitle contains HTML tags such as <a, <img, <style, or <div characters.
User profiles where name or email fields include angle brackets, quotation marks, or URL-encoded HTML.
Outbound approval emails containing anchor tags whose href does not match the configured Unleash base URL.

Detection Strategies

Audit the Unleash database and application logs for change-request titles containing HTML markup or event handler attributes.
Inspect email gateway logs for approval notifications from Unleash whose HTML body contains links to external domains.
Review project membership and change-request creation activity for accounts that submitted unusual title strings.

Monitoring Recommendations

Alert on change requests created with titles longer than expected or containing <, >, or href= substrings.
Log the version of the Unleash instance and flag any deployment still running a release below 8.0.3.
Monitor approver mailboxes for reports of suspicious links attributed to Unleash notifications.

How to Mitigate CVE-2026-76909

Immediate Actions Required

Upgrade Unleash to version 8.0.3 or later, which applies HTML escaping to the affected email fields.
Review recently created change requests for injected HTML and remediate suspicious entries.
Notify approvers to validate the destination of change-request review links before clicking.

Patch Information

The fix is included in Unleash 8.0.3. The vendor advisory is published as GitHub Security Advisory GHSA-7hvx-28gp-mf6j and the release notes are available in GitHub Release v8.0.3. The specific code change is documented in GitHub Commit 7c89ced, where the template moves from triple-brace to double-brace Mustache interpolation.

Workarounds

Disable change-request approval emails until the upgrade to 8.0.3 is completed.
Restrict the ability to create change requests to trusted project members.
Enforce input validation at the API layer to reject change-request titles containing HTML characters.

bash

# Upgrade Unleash to the patched release
docker pull unleashorg/unleash-server:8.0.3
docker stop unleash && docker rm unleash
docker run -d --name unleash -p 4242:4242 \
  -e DATABASE_URL="$DATABASE_URL" \
  unleashorg/unleash-server:8.0.3