Description

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.1",
  "pubDate": "2026-08-21T19:17:32.117Z",
  "pubdate": "2026-08-21T19:17:32.117Z",
  "executiveSummary": "Unleash prior to version 8.0.3 suffers from a vulnerability where the Mustache template escaping mechanism is globally disabled during feature event formatting.\nSpecifically, the FeatureEventFormatterMd.format function assigns Mustache.escape to an identity function, which alters the process-wide behavior for all subsequent Mustache.render invocations.\nThis impacts critical outbound notification services including email-service.ts, webhook.ts, datadog.ts, and new-relic.ts, leaving them vulnerable to injection attacks.\nAn attacker with editor-level privileges can exploit this flaw by placing malicious Slack or Microsoft Teams link syntax into an unrestricted username field and triggering a feature event.\nThe resulting impact allows the injection of attacker-labeled, trusted links into outbound notification channels, potentially facilitating phishing or social engineering campaigns against recipients.\nExploitation requires editor-level privileges within the Unleash platform and the ability to generate specific feature events that invoke the flawed formatting logic.",
  "technicalDetails": "The root cause of the vulnerability resides in src/lib/addons/feature-event-formatter-md.ts within the FeatureEventFormatterMd.format function.\nDuring the rendering of action and path templates, the application assigns Mustache.escape to an identity function, effectively bypassing HTML and markup escaping mechanisms.\nBecause the Mustache library manages escaping on a process-wide level rather than per-instance, this assignment persists across the Node.js process.\nConsequently, subsequent calls to Mustache.render within other notification handlers—namely email-service.ts, webhook.ts, datadog.ts, and new-relic.ts—also operate without escaping until the application is restarted.\nThe step-by-step attack flow proceeds as follows: 1) An authenticated user with editor-level privileges inputs malicious Slack or Microsoft Teams link syntax into an unrestricted username field. 2) The user triggers a feature event that invokes FeatureEventFormatterMd.format. 3) The function overwrites Mustache.escape globally with a no-op identity function. 4) The notification subsystem renders outbound payloads using the unescaped Mustache context. 5) An attacker-labeled link is successfully injected into trusted outbound notification channels such as webhooks or emails, deceiving recipients who trust the originating communication channel.\nThe affected component is the feature event markdown formatter in Unleash versions prior to 8.0.3.\nAuthentication and privilege requirements mandate at least an editor-level user account within the Unleash platform to manipulate input fields such as usernames."
}