{"id":"GHSA-7hvx-28gp-mf6j","summary":"Unleash: CR-approval email renders user-controlled raw HTML","details":"### Summary\nThe change-request approval HTML email template renders fields as raw HTML. User who can create a change request can inject HTML into approval notification emails. I was not able to confirm Enterprise platform is using vulnerable code nor that it doesn't sanitize input.\n\n### Details\n`src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache` uses Mustache triple-stash syntax for fields that can originate from users:\n\n```mustache\n{{{ changeRequestTitle }}}\n{{{ requesterName }}}\n{{{ requesterEmail }}}\n{{{ changeRequestLink }}}\n```\n\nTriple-stash disables HTML escaping even when Mustache's global escape function is safe. The related renderer is `sendRequestedCRApprovalEmail` in `src/lib/services/email-service.ts`, which renders the template with `Mustache.render`.\n\n### PoC\n1. Use an Enterprise deployment with change requests and approval emails enabled.\n2. As a project member who can create change requests, set a display name or change-request title to HTML such as:\n\n```html\n\u003c/a\u003e\u003ca href=\"https://example.com\"\u003eApprove change request\u003c/a\u003e\n```\n\n3. Create a change request that requires approval.\n4. Observe that the approval email contains attacker-controlled raw HTML instead of escaped text.\n\n### Impact\nChange-request approvers can receive forged links, tracking pixels, or visually altered email content.","aliases":["CVE-2026-76909"],"modified":"2026-09-22T21:00:07.994508798Z","published":"2026-09-22T20:34:38Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-09-22T20:34:38Z","nvd_published_at":null,"cwe_ids":["CWE-79"],"severity":"LOW"},"references":[{"type":"WEB","url":"https://github.com/Unleash/unleash/security/advisories/GHSA-7hvx-28gp-mf6j"},{"type":"WEB","url":"https://github.com/Unleash/unleash/commit/7c89cedcbbb5aa826951373569930e0a3c4358db"},{"type":"PACKAGE","url":"https://github.com/Unleash/unleash"},{"type":"WEB","url":"https://github.com/Unleash/unleash/releases/tag/v8.0.3"}],"affected":[{"package":{"name":"unleash-server","ecosystem":"npm","purl":"pkg:npm/unleash-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.0.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-7hvx-28gp-mf6j/GHSA-7hvx-28gp-mf6j.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}