{"items":[{"id":"NVI-00016411","kind":"vulnerability","title":"Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-w4mq-xh27-6xpx","CVE-2026-63466"],"plain_summary":"GitHub lists this reviewed advisory for unleash-server. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6ecca27381000ce7011e25f28c6bde45"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-21T19:14:52.000Z","value":"4.1 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6ecca27381000ce7011e25f28c6bde45"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6ecca27381000ce7011e25f28c6bde45","url":"https://github.com/advisories/GHSA-w4mq-xh27-6xpx","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-w4mq-xh27-6xpx","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T09:56:46.713Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6ecca27381000ce7011e25f28c6bde45"],"technology":"unleash-server","known_exclusions":[],"conditions_summary":"## Vulnerability Details\n\n**File**: `src/lib/addons/feature-event-formatter-md.ts`\n**Line**: 355 (in v8.0.1; `format()` method)\n\n### Root Cause\n\n`FeatureEventFormatterMd.format()` does:\n\n```ts\nMustache.escape = (text) => text;\nconst text = Mustache.render(action, context);\n```\n\n`mustache` (pinned `^4.2.0`, confirmed installed `4.2.0`) keeps `escape` as a **module-level singleton** (`mustache.js`: `mustache.escape = escapeHtml;`), read by every `Mustache.render()` call in the process unless a per-call `config.escape` override is passed (`var escape = this.getConfigEscape(config) || mustache.escape;`). Node's module cache guarantees every `import Mustache from 'mustache'` in the process — `feature-event-formatter-md.ts`, `email-service.ts`, `webhook.ts`, `datadog.ts`, `new-relic.ts` — shares the same object instance.\n\nThis assignment therefore **permanently disables HTML escaping for every other `Mustache.render()` call in the same Node process** (including `email-service.ts` templates) from the moment any single notification addon (Webhook, Slack legacy, Microsoft Teams, Datadog, New Relic) first formats any event, for the remaining lifetime of the process.\n\n`feature-event-formatter","public_affected_ranges":["< 8.0.3"]}],"null_published_at":"2026-11-04T10:04:27.942Z","source_updated_at":"2026-08-21T19:14:52.000Z","source_disclosed_at":"2026-08-21T19:14:52.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T09:56:46.713Z"}],"next_cursor":null,"snapshot_revision":"42594"}