CVE-2026-76909: 
JavaScript vulnerability analysis and mitigation

CVE-2026-76909 is an HTML injection vulnerability in Unleash, an open-source feature management platform, affecting all versions prior to 8.0.3 (npm package unleash-server ≤ 7.6.4). The flaw exists in the change-request approval email template, which renders user-controlled fields without HTML escaping, allowing a project member to inject arbitrary HTML into approver notification emails. It was disclosed on July 10, 2026, via a GitHub Security Advisory and assigned a CVSS v4.0 base score of 2.1 (Low) (GitHub Advisory).

The root cause is improper neutralization of user-controlled input before inclusion in HTML output (CWE-79). The Mustache template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache uses triple-stash syntax ({{{ }}}) for the changeRequestTitle, requesterName, and requesterEmail fields, which explicitly disables Mustache's built-in HTML escaping. The sendRequestedCRApprovalEmail function in src/lib/services/email-service.ts passes these user-supplied values directly to Mustache.render() without sanitization. Exploitation requires the attacker to be a project member with permission to create change requests on an Enterprise deployment where approval emails are enabled (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to inject arbitrary HTML content into approval notification emails sent to change-request approvers. This can result in forged hyperlinks (e.g., phishing links), embedded tracking pixels for user profiling, or visually manipulated email content designed to deceive recipients. The vulnerability has no direct impact on the confidentiality or integrity of the Unleash server itself, but poses a low risk to subsequent systems through social engineering of approvers (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires authenticated access as a project member on an Enterprise deployment with approval emails enabled, significantly limiting the attack surface (GitHub Advisory).

1. Gain project membership: Obtain or register an account with project member privileges on a target Unleash Enterprise deployment that has change-request approval emails enabled.
2. Craft a malicious payload: Set a display name or change-request title to an HTML payload, for example: <a href="https://attacker.com/phish">Click here to approve</a> or an image tag for tracking: <img src="https://attacker.com/track.png" />.
3. Create a change request: Submit a change request using the crafted title or from the account with the malicious display name, triggering the approval email workflow.
4. Email delivery: The Unleash server renders the approval notification email using the vulnerable Mustache template, embedding the raw HTML payload into the email body sent to the approver.
5. Approver interaction: The approver receives the email containing attacker-controlled HTML — clicking a forged link may lead to credential phishing, or the tracking pixel silently confirms email delivery (GitHub Advisory).

• Email Content: Approval notification emails containing unexpected HTML tags (e.g., <a>, <img>, <script>) in the change request title, requester name, or requester email fields.
• Logs: Unleash application logs showing change requests created by project members with unusually long or HTML-formatted titles or display names.
• Network: Outbound HTTP requests from approver mail clients to unknown external domains shortly after receiving a change-request approval email (indicative of tracking pixel loading or phishing link clicks).

Upgrade the unleash-server npm package to version 8.0.3 or later, which replaces triple-stash Mustache syntax ({{{ }}}) with standard double-stash ({{ }}) for user-controlled fields, restoring HTML escaping. No configuration-based workaround is available; disabling approval emails entirely would eliminate the attack vector if upgrading immediately is not possible (GitHub Advisory, v8.0.3 Release).