{"id":"CVE-2026-63466","summary":"Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username","details":"Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3.","aliases":["GHSA-w4mq-xh27-6xpx"],"modified":"2026-08-23T03:49:31.994480669Z","published":"2026-08-21T18:21:46.526Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63466.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-116"]},"references":[{"type":"WEB","url":"https://github.com/Unleash/unleash/releases/tag/v8.0.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63466.json"},{"type":"ADVISORY","url":"https://github.com/Unleash/unleash/security/advisories/GHSA-w4mq-xh27-6xpx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63466"},{"type":"FIX","url":"https://github.com/Unleash/unleash/commit/002012cfdbedd2e9b7db9dc83b9f549f761db22e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/unleash/unleash","events":[{"introduced":"0"},{"fixed":"002012cfdbedd2e9b7db9dc83b9f549f761db22e"},{"fixed":"ebb398aeeefaf3bb8b4020237d1b706462d1a00e"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"8.0.3"}]}}],"versions":["v7.5.1","v8.0.2","v8.0.1","v8.0.0","v7.6.5-beta.2","v7.6.5-beta.1","v7.6.5-beta.0","v7.6.3","v7.6.2","v7.6.1","v7.6.0","v7.5.0","v7.4.3","v7.4.2","v7.4.1","v7.4.0","v7.3.0","v7.2.3","v7.2.0","v7.1.2","v7.1.1","v7.1.0","v7.0.6","v7.0.5","v7.0.4","v7.0.3","v7.0.2","v7.0.1","v7.0.0","v6.10.0","v6.9.2","v6.9.1","v6.9.0","v6.8.0","v6.7.2","v6.7.1","v6.7.0","v6.6.0","v6.5.2","v6.5.0","v6.5.1","v5.1.0-beta.54","v5.1.0-beta.53","v5.1.0-beta.52","v5.1.0-beta.51","v5.1.0-beta.50","v5.1.0-beta.49","v5.1.0-beta.48","v5.1.0-beta.47","v5.1.0-beta.46","v5.1.0-beta.45","v5.1.0-beta.44","v5.1.0-beta.43","v5.1.0-beta.42","v5.1.0-beta.41","v5.1.0-beta.40","v5.1.0-beta.39","v5.1.0-beta.38","v5.1.0-beta.37","v5.1.0-beta.36","v5.1.0-beta.35","v5.1.0-beta.34","v5.1.0-beta.33","v5.1.0-beta.31","v5.1.0-beta.30","v5.1.0-beta.29","v5.1.0-beta.28","v5.1.0-beta.27","v5.1.0-beta.26","v5.1.0-beta.25","v5.1.0-beta.24","v5.1.0-beta.23","v5.1.0-beta.22","v5.1.0-beta.21","v5.1.0-beta.20","v5.1.0-beta.19","v5.1.0-beta.18","v5.1.0-beta.17","v5.1.0-beta.16","v5.1.0-beta.15","v5.1.0-beta.14","v5.1.0-beta.13","v5.1.0-beta.12","v5.1.0-beta.11","v5.1.0-beta.10","v5.1.0-beta.9","v5.1.0-beta.8","v5.1.0-beta.7","v5.1.0-beta.6","v5.1.0-beta.5","v5.1.0-beta.4","v5.1.0-beta.3","v5.1.0-beta.2","v5.1.0-beta.1","v5.1.0-beta.0","v5.0.0","v5.0.0-beta.2","v5.0.0-beta.1","v4.23.0-beta.84","v4.23.0-beta.83","v4.23.0-beta.82","v4.23.0-beta.81","v4.23.0-beta.80","v4.23.0-beta.79","v4.23.0-beta.78","v4.23.0-beta.77","v4.23.0-beta.76","v4.23.0-beta.75","v4.23.0-beta.74","v4.23.0-beta.73","v4.23.0-beta.72","v4.23.0-beta.71","v4.23.0-beta.70","v4.23.0-beta.69","v4.23.0-beta.68","v4.23.0-beta.67","v4.23.0-beta.66","v4.23.0-beta.65","v4.23.0-beta.64","v4.23.0-beta.63","v4.23.0-beta.62","v4.23.0-beta.61","v4.23.0-beta.60","v4.23.0-beta.59","v4.23.0-beta.58","v4.23.0-beta.57","v4.23.0-beta.56","v4.23.0-beta.55","v4.23.0-beta.54","v4.23.0-beta.53","v4.23.0-beta.52","v4.23.0-beta.51","v4.23.0-beta.50","v4.23.0-beta.49","v4.23.0-beta.48","v4.23.0-beta.47","v4.23.0-beta.46","v4.23.0-beta.45","v4.23.0-beta.44","v4.23.0-beta.43","v4.23.0-beta.42","v4.23.0-beta.41","v4.23.0-beta.40","v4.23.0-beta.39","v4.23.0-beta.38","v4.23.0-beta.37","v4.23.0-beta.36","v4.23.0-beta.35","v4.23.0-beta.34","v4.23.0-beta.33","v4.23.0-beta.32","v4.23.0-beta.30","v4.23.0-beta.31","v4.23.0-beta.29","v4.23.0-beta.28","v4.23.0-beta.27","v4.23.0-beta.26","v4.23.0-beta.25","v4.23.0-beta.24","v4.23.0-beta.23","v4.23.0-beta.22","v4.23.0-beta.21","v4.23.0-beta.20","v4.23.0-beta.19","v4.23.0-beta.18","v4.23.0-beta.17","v4.23.0-beta.16","v4.23.0-beta.15","v4.23.0-beta.12","v4.23.0-beta.14","v4.23.0-beta.13","v4.23.0-beta.11","v4.23.0-beta.10","v4.23.0-beta.9","v4.23.0-beta.8","v4.23.0-beta.7","v4.23.0-beta.6","v4.23.0-beta.5","v4.22.0","v4.23.0-beta.4","v4.23.0-beta.3","v4.23.0-beta.2","v4.23.0-beta.1","v4.23.0-beta.0","v4.22.0-beta.141","v4.22.0-beta.140","v4.22.0-beta.139","v4.22.0-beta.138","v4.22.0-beta.137","v4.22.0-beta.136","v4.22.0-beta.135","v4.22.0-beta.134","v4.22.0-beta.133","v4.22.0-beta.132","v4.22.0-beta.131","v4.22.0-beta.130","v4.22.0-beta.129","v4.22.0-beta.128","v4.22.0-beta.127","v4.22.0-beta.126","v4.22.0-beta.125","v4.22.0-beta.124","v4.22.0-beta.123","v4.22.0-beta.122","v4.22.0-beta.121","v4.22.0-beta.120","v4.22.0-beta.119","v4.22.0-beta.118","v4.22.0-beta.117","v4.22.0-beta.116","v4.22.0-beta.115","v4.22.0-beta.114","v4.22.0-beta.113","v4.22.0-beta.112","v4.22.0-beta.111","v4.22.0-beta.110","v4.22.0-beta.109","v4.22.0-beta.108","v4.22.0-beta.107","v4.22.0-beta.106","v4.21.0","v4.22.0-beta.105","v4.22.0-beta.104","v4.22.0-beta.103","v4.22.0-beta.102","v4.22.0-beta.101","v4.22.0-beta.100","v4.22.0-beta.99","v4.22.0-beta.98","v4.22.0-beta.97","v4.22.0-beta.96","v4.22.0-beta.95","v4.22.0-beta.94","v4.22.0-beta.93","v4.22.0-beta.92","v4.22.0-beta.91","v4.22.0-beta.90","v4.22.0-beta.89","v4.22.0-beta.88","v4.22.0-beta.87","v4.22.0-beta.86","v4.22.0-beta.85","v4.22.0-beta.84","v4.22.0-beta.83","v4.22.0-beta.82","v4.22.0-beta.81","v4.22.0-beta.80","v4.22.0-beta.79","v4.22.0-beta.78","v4.22.0-beta.77","v4.22.0-beta.76","v4.22.0-beta.75","v4.22.0-beta.74","v4.22.0-beta.73","v4.22.0-beta.72","v4.22.0-beta.71","v4.22.0-beta.70","v4.22.0-beta.69","v4.22.0-beta.68","v4.22.0-beta.67","v4.22.0-beta.66","v4.22.0-beta.65","v4.22.0-beta.64","v4.22.0-beta.63","v4.22.0-beta.62","v4.22.0-beta.61","v4.22.0-beta.60","v4.22.0-beta.59","v4.22.0-beta.58","v4.22.0-beta.57","v4.22.0-beta.56","v4.22.0-beta.55","v4.22.0-beta.54","v4.22.0-beta.53","v4.22.0-beta.52","v4.22.0-beta.51","v4.22.0-beta.50","v4.22.0-beta.49","v4.22.0-beta.48","v4.22.0-beta.47","v4.22.0-beta.46","v4.22.0-beta.45","v4.22.0-beta.44","v4.22.0-beta.43","v4.22.0-beta.42","v4.22.0-beta.41","v4.22.0-beta.40","v4.22.0-beta.39","v4.22.0-beta.38","v4.22.0-beta.37","v4.22.0-beta.36","v4.22.0-beta.35","v4.22.0-beta.33","v4.22.0-beta.34","v4.22.0-beta.32","v4.22.0-beta.31","v4.22.0-beta.30","v4.22.0-beta.29","v4.22.0-beta.28","v4.22.0-beta.27","v4.22.0-beta.26","v4.22.0-beta.25","v4.22.0-beta.24","v4.22.0-beta.23","v4.22.0-beta.22","v4.22.0-beta.21","v4.22.0-beta.20","v4.22.0-beta.19","v4.22.0-beta.18","v4.22.0-beta.17","v4.22.0-beta.16","v4.22.0-beta.15","v4.22.0-beta.14","v4.22.0-beta.13","v4.22.0-beta.12","v4.22.0-beta.11","v4.22.0-beta.10","v4.22.0-beta.9","v4.22.0-beta.8","v4.22.0-beta.7","v4.22.0-beta.6","v4.22.0-beta.5","v4.22.0-beta.4","v4.22.0-beta.3","v4.22.0-beta.2","v4.22.0-beta.1","v4.21.1-beta.0","v4.21.0-beta.57","v4.21.0-beta.56","v4.21.0-beta.55","v4.21.0-beta.54","v4.21.0-beta.53","v4.21.0-beta.52","v4.21.0-beta.51","v4.21.0-beta.50","v4.21.0-beta.49","v4.21.0-beta.48","v4.21.0-beta.47","v4.21.0-beta.46","v4.21.0-beta.45","v4.21.0-beta.44","v4.21.0-beta.43","v4.21.0-beta.42","v4.21.0-beta.41","v4.21.0-beta.40","v4.21.0-beta.39","v4.21.0-beta.38","v4.21.0-beta.37","v4.21.0-beta.36","v4.21.0-beta.35","v4.21.0-beta.34","v4.21.0-beta.33","v4.21.0-beta.32","v4.21.0-beta.31","v4.21.0-beta.30","v4.21.0-beta.29","v4.21.0-beta.28","v4.21.0-beta.27","v4.21.0-beta.26","v4.21.0-beta.25","v4.21.0-beta.24","v4.21.0-beta.23","v4.21.0-beta.22","v4.21.0-beta.21","v4.21.0-beta.20","v4.21.0-beta.19","v4.21.0-beta.18","v4.21.0-beta.17","v4.21.0-beta.16","v4.21.0-beta.15","v4.21.0-beta.8","v4.21.0-beta.7","v4.21.0-beta.6","v4.21.0-beta.5","v4.21.0-beta.4","v4.21.0-beta.3","v4.21.0-beta.2","v4.21.0-beta.1","v4.21.0-beta.0","v4.20.0-beta.6","v4.20.0-beta.5","v4.20.0-beta.4","v4.20.0-beta.3","v4.19.1","v4.20.0-beta.2","v4.20.0-beta.1","v4.20.0-beta.0","v4.19.0","v4.19.0-beta.2","v4.19.0-beta.1","v4.19.0-beta.0","v4.18.7","v4.18.6","v4.18.5","v4.18.4","v4.18.1","v4.18.0","v4.18.0-beta.14","v4.18.0-beta.13","v4.18.0-beta.12","v4.18.0-beta.11","v4.18.0-beta.10","v4.18.0-beta.9","v4.18.0-beta.8","v4.18.0-beta.7","v4.18.0-beta.6","v4.18.0-beta.5","v4.18.0-beta.4","v4.18.0-beta.3","v4.18.0-beta.2","v4.18.0-beta.1","v4.18.0-beta.0","v4.17.0-beta.11","v4.17.0-beta.10","v4.17.0-beta.9","v4.17.0-beta.8","v4.17.0-beta.7","v4.17.0-beta.6","v4.17.0-beta.5","v4.17.0-beta.4","v4.17.0-beta.3","v4.17.0-beta.2","v4.17.0-beta.1","v4.17.0-beta.0","v4.16.0","v4.15.1","v4.15.0-beta.10","v4.15.0-beta.9","v4.15.0-beta.8","v4.15.0-beta.7","v4.15.0-beta.6","v4.15.0-beta.5","v4.15.0-beta.4","v4.15.0-beta.2","v4.15.0-beta.1","v4.15.0-beta.0","v4.14.0","v4.14.0-beta.4","v4.14.0-beta.3","v4.14.0-beta.2","v4.14.0-beta.0","v4.13.0-beta.5","v4.13.0-beta.4","v4.13.0-beta.3","v4.13.0-beta.2","v4.13.0-beta.0","v4.11.0-beta.2","v4.11.0-beta.1","v4.11.0-beta.0","v4.10.0","v4.10.0-beta.6","v4.9.1","v4.8.2","v4.2.3","v4.10.0-beta.5","v4.10.0-beta.4","v4.10.0-beta.3","v4.10.0-beta.2","v4.10.0-beta.1","v4.10.0-beta.0","v4.5.1","v4.9.0","v4.9.0-beta.0","v4.7.2","v4.6.5","v4.8.1","v4.8.0","v4.8.0-beta.2","v4.4.5","v4.8.0-beta.1","v4.8.0-beta.0","v4.7.1","v4.7.0","v4.6.4","v4.6.3","v4.6.1","v4.6.0","v4.6.0-beta.9","v4.6.0-beta.8","v4.6.0-beta.7","v4.6.0-beta.6","v4.6.0-beta.5","v4.6.0-beta.4","v4.6.0-beta.3","v4.2.2","v4.2.1","v4.2.0","v4.2.0-beta.10","v4.2.0-beta.9","v4.2.0-beta.8","v4.2.0-beta.7","v4.2.0-beta.6","v4.2.0-beta.5","v4.2.0-beta.4","v4.2.0-beta.3","v4.2.0-beta.2","v4.2.0-beta.1","v4.1.2","v4.2.0-2","v4.2.0-1","v4.2.0-0","v4.1.4-0","v4.1.3-0","v4.1.1","v4.1.0","v4.1.0-beta.15","v4.1.0-beta.14","v4.1.0-beta.13","v4.1.0-beta.12","v4.1.0-beta.11","v4.1.0-beta.10","v4.1.0-beta.9","v4.1.0-beta.8","v4.1.0-beta.7","v4.1.0-beta.6","v4.1.0-beta.5","v4.1.0-beta.4","v4.1.0-beta.3","v4.1.0-beta.2","v4.1.0-beta.1","v4.1.0-beta.0","v4.0.6-beta.1","v4.0.3","v4.0.2","v4.0.1","v4.0.0","v4.0.0-beta.6","v4.0.0-beta.5","v4.0.0-beta.4","v4.0.0-beta.3","v4.0.0-beta.2","v4.0.0-beta.1","v4.0.0-beta.0","v4.0.0-alpha.8","v4.0.0-alpha.7","v4.0.0-alpha.6","v4.0.0-alpha.4","v4.0.0-alpha.3","v3.17.4","v4.0.0-alpha.2","v4.0.0-alpha.1","v4.0.0-alpha.0","v3.17.2","v3.16.0","v3.17.1","v3.15.0","v3.14.0","v3.13.0","v3.12.0","v3.11.2","v3.11.1","v3.11.0","v3.10.1","v3.9.0","v3.8.0","v3.7.0","v3.6.0","v3.5.3","v3.5.2","v3.5.0","v3.5.0-0","v3.4.2","v3.4.0","v3.3.6","v3.3.5","v3.3.4","v3.3.3","v3.3.2","v3.3.1","v3.3.0","v3.2.30","v3.2.29","v3.2.28","v3.2.27","v3.2.26"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63466.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N"}]}