CVE-2026-63466: 
JavaScript vulnerability analysis and mitigation

CVE-2026-63466 is a global Mustache.escape override vulnerability in Unleash, an open-source feature management platform, that disables HTML escaping process-wide and enables Slack/Microsoft Teams link-injection via an unrestricted username. The vulnerability affects unleash-server (npm) versions prior to 8.0.3 and was published on July 10, 2026, with the advisory added to the GitHub Advisory Database on August 21, 2026. It carries a CVSS v3.1 base score of 4.1 (Medium) (Github Advisory).

The root cause is in src/lib/addons/feature-event-formatter-md.ts (line 355 in v8.0.1), where FeatureEventFormatterMd.format() assigns Mustache.escape = (text) => text; — an identity function — before calling Mustache.render(). Because the mustache library (v4.2.0) stores escape as a module-level singleton shared across all imports via Node.js's module cache, this assignment permanently disables HTML escaping for every subsequent Mustache.render() call in the process, including those in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. The {{user}} template placeholder interpolates event.createdBy (the acting user's username or email), and neither username nor display name fields have any character or length validation beyond a basic type check (Joi.string()), allowing an attacker to embed raw Slack/Teams link syntax (e.g., <https://attacker.example|Click here>) directly into outbound notifications. This is classified as CWE-116 (Improper Encoding or Escaping of Output) (Github Advisory, Unleash Security Advisory).

An Editor-level attacker can inject phishing links into any configured outbound notification channel — Slack (legacy), Microsoft Teams, Webhook, Datadog, or New Relic — by crafting a malicious username, causing recipients to see attacker-labeled, clickable hyperlinks within trusted automated notification feeds. Secondarily, the global escaping override remains active for the entire lifetime of the Node.js process until restart, increasing the exploitability of any other Mustache rendering sink (including email templates). Tertiarily, custom Webhook body templates that interpolate raw user fields into JSON string literals can have their JSON structure broken by an attacker-controlled " character once escaping is disabled (Github Advisory).

No public exploit code or in-the-wild exploitation has been reported. The vulnerability requires only an Editor-level account on a single project, which may be obtainable via public self-registration (POST /invite/:token/signup requires no permissions) if the instance allows it. The EPSS score is approximately 0.183% (8th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and NVD SSVC assessment indicates exploitation is currently "none" (Github Advisory, Feedly).

1. Obtain an Editor-level account: Register or obtain an Editor-level account on the target Unleash instance. If public invite-based signup is enabled, use POST /invite/:token/signup (no prior permissions required) to self-register.
2. Set a malicious username: Update the account's username (or display name) to contain Slack/Teams link injection syntax, e.g., evil<https://attacker.example/urgent-rollback|Click here to view incident>. No server-side sanitization will reject this input.
3. Confirm notification addons are active: Verify (or infer from organizational context) that at least one outbound notification addon is configured — Slack (legacy), Microsoft Teams, Webhook, Datadog, or New Relic.
4. Trigger a feature event: As the Editor user, perform any ordinary write action such as creating, updating, or toggling a feature flag. This triggers handleEvent() in the configured addon.
5. Global escape override fires: The addon calls FeatureEventFormatterMd.format(), which sets Mustache.escape = (text) => text, permanently disabling HTML escaping process-wide for the remainder of the Node.js process lifetime.
6. Malicious link delivered: The rendered notification message containing the raw attacker-controlled link syntax is POSTed to the configured Slack/Teams channel or webhook endpoint, where it renders as a real, clickable, attacker-labeled hyperlink in the trusted notification feed, enabling phishing attacks against notification recipients (Github Advisory, Unleash Security Advisory).

• Logs: Unleash audit logs showing a user account created or updated with a username containing <, >, or | characters (Slack/Teams link syntax); feature flag creation or modification events immediately following a username change by a low-privileged Editor account.
• Network: Outbound webhook POST requests from the Unleash server to Slack, Teams, Datadog, or New Relic endpoints containing unescaped <, >, or | characters in the createdBy or user fields of the payload body.
• Application Behavior: Notification messages appearing in Slack/Teams channels from Unleash that contain clickable hyperlinks attributed to a user action, where the link destination is an external or unexpected domain; any Mustache-rendered email or webhook content containing unescaped HTML special characters after the first feature event notification is processed (Github Advisory).

Upgrade unleash-server (npm) to version 8.0.3 or later, which resolves the issue by replacing the global Mustache.escape mutation with a per-call render configuration ({ escape: (text: string) => text } passed as the fourth argument to Mustache.render()). The fix was applied in commit 002012c (Unleash Commit, Unleash Release). As a temporary workaround prior to patching, administrators can disable outbound notification addons (Slack, Teams, Webhook, Datadog, New Relic) and restrict user self-registration to limit attacker account creation. Restarting the Node.js process will restore the default Mustache.escape behavior until the next vulnerable code path is triggered.

The vulnerability was reported by iaohkut-from-NightWolf-Team and the advisory was published by Unleash maintainer chriswk on July 10, 2026. No significant broader media coverage or notable public researcher commentary beyond the GitHub advisory has been identified at this time (Github Advisory).