CVE-2026-63466

Name of the Vulnerable Software and Affected Versions Unleash versions prior to 8.0.3

Description In the FeatureEventFormatterMd.format function within src/lib/addons/feature-event-formatter-md.ts, the Mustache.escape property is assigned to an identity function before rendering action and path templates. Since Mustache.escape is process-wide, this assignment disables escaping for all subsequent Mustache.render calls across email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. A user with editor-level privileges can exploit this by placing Slack or Microsoft Teams link syntax in an unrestricted username and triggering a feature event. This allows the injection of an attacker-labeled link into a trusted outbound notification channel, leaving other Mustache sinks unescaped until the system is restarted.

Recommendations Update to version 8.0.3.