CVE-2026-63466 Unleash CVE debrief

Who should care

Users of Unleash open-source feature management platform, especially those with editor-level access to username configuration, should be aware of this vulnerability and take steps to mitigate it by updating to version 8.0.3 or later. This includes administrators, security teams, and developers who manage or interact with the Unleash platform.

Technical summary

The vulnerability in Unleash, tracked as CVE-2026-63466, involves the FeatureEventFormatterMd.format function in src/lib/addons/feature-event-formatter-md.ts. This function assigns Mustache.escape to an identity function, effectively disabling escaping for subsequent Mustache.render calls. This allows an editor-level user to inject links into outbound notifications via crafted Slack or Microsoft Teams syntax in usernames. The issue is fixed in version 8.0.3. A CVSS score of 4.1 reflects the potential impact on confidentiality.

Defensive priority

CVE-2026-63466 is rated MEDIUM with a CVSS score of 4.1. Editors with access to username configuration could inject links into trusted channels via crafted Slack or Microsoft Teams syntax, impacting confidentiality. Users should prioritize updating to version 8.0.3.

Recommended defensive actions

• Update to version 8.0.3 or later
• Review and restrict username configuration for editor-level users
• Monitor outbound notifications for suspicious links
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Unleash, an open-source feature management platform. The issue involves FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts, which disables Mustache escaping. This allows an editor-level user to inject links into outbound notifications. The issue is fixed in version 8.0.3.

Official resources