CVE-2026-76909: Unleash Server HTML Injection in Change-Request Approval Emails
Summary
CVE-2026-76909: Unleash: CR-approval email renders user-controlled raw HTML. Affects unleash-server versions < 8.0.3. Fixed in 8.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unleash is an open-source feature management platform that allows teams to manage feature flags and control the rollout of features in their applications. It provides a user-friendly interface for creating and managing change requests, which can be approved by designated team members. However, a vulnerability exists in the email notification system that can lead to HTML injection, potentially compromising the integrity of the approval process.
Vulnerability Detail
The vulnerability arises from the use of Mustache's triple-stash syntax in the email template for change-request approval notifications. This syntax renders user-controlled fields as raw HTML without escaping, allowing an attacker to inject malicious HTML content. The affected fields include change request title, requester name, requester email, and change request link. If exploited, this could lead to phishing attacks, where approvers receive forged links or tracking pixels, thereby compromising sensitive information.
How To Fix
Minimum fixed version
8.0.3
This is the first release that contains the fix.
npm install unleash-server@8.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using HTML characters in the change request title or requester name until the package is updated. Ensure that all user inputs are sanitized before being rendered in the email templates.
Conclusion
CVE-2026-76909 presents a significant risk to users of the Unleash server due to the potential for HTML injection in approval emails. It is crucial to update to the patched version 8.0.3 to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for unleash-server →
FAQ
CVE-2026-76909 is a vulnerability in the Unleash server that allows HTML injection in change-request approval emails, potentially leading to phishing attacks.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without any signup.
The vulnerability can lead to forged links in approval emails, tracking pixels, or visually altered content, which may compromise sensitive information of the approvers.
Yes, a patch is available in version 8.0.3 of the 'unleash-server' package. Updating to this version will resolve the vulnerability.
If immediate updating is not possible, avoid using HTML in user-controlled fields and sanitize all inputs to minimize the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for unleash-server.
