https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 03:53:40 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-63466 <p>Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3.</p> <p>Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3.</p> https://db.gcve.eu/vuln/fkie_cve-2026-63466 https://db.gcve.eu/vuln/ghsa-w4mq-xh27-6xpx <p><strong>Affected:</strong> npm: unleash-server</p> <p>## Vulnerability Details</p> <p>**File**: `src/lib/addons/feature-event-formatter-md.ts` **Line**: 355 (in v8.0.1; `format()` method)</p> <p>### Root Cause</p> <p>`FeatureEventFormatterMd.format()` does:</p> <p>```ts Mustache.escape = (text) =&gt; text; const text = Mustache.render(action, context); ```</p> <p>`mustache` (pinned `^4.2.0`, confirmed installed `4.2.0`) keeps `escape` as a **module-level singleton** (`mustache.js`: `mustache.escape = escapeHtml;`), read by every `Mustache.render()` call in the process unless a per-call `config.escape` override is passed (`var escape = this.getConfigEscape(config) || mustache.escape;`). Node&#39;s module cache guarantees every `import Mustache from &#39;mustache&#39;` in the process — `feature-event-formatter-md.ts`, `email-service.ts`, `webhook.ts`, `datadog.ts`, `new-relic.ts` — shares the same object instance.</p> <p>This assignment therefore **permanently disables HTML escaping for every other `Mustache.render()` call in the same Node process** (including `email-service.ts` templates) from the moment any single notification addon (Webhook, Slack legacy, Microsoft Teams, Datadog, New Relic) first formats any event, for the remaining lifetime of the process.</p> <p>`feature-event-formatter-md-events.ts` (`EVENT_MAP`) confirms the blast radius: nearly every event&#39;s `action` template interpolates attacker-controlled values with single-mustache (intended-to-be-escaped) syntax, most importantly `{{user}}`, which is `event.createdBy` — the acting account&#39;s `username` (or `email` if set;…</p> <p><strong>Affected:</strong> npm: unleash-server</p> <p>## Vulnerability Details</p> <p>**File**: `src/lib/addons/feature-event-formatter-md.ts` **Line**: 355 (in v8.0.1; `format()` method)</p> <p>### Root Cause</p> <p>`FeatureEventFormatterMd.format()` does:</p> <p>```ts Mustache.escape = (text) =&gt; text; const text = Mustache.render(action, context); ```</p> <p>`mustache` (pinned `^4.2.0`, confirmed installed `4.2.0`) keeps `escape` as a **module-level singleton** (`mustache.js`: `mustache.escape = escapeHtml;`), read by every `Mustache.render()` call in the process unless a per-call `config.escape` override is passed (`var escape = this.getConfigEscape(config) || mustache.escape;`). Node&#39;s module cache guarantees every `import Mustache from &#39;mustache&#39;` in the process — `feature-event-formatter-md.ts`, `email-service.ts`, `webhook.ts`, `datadog.ts`, `new-relic.ts` — shares the same object instance.</p> <p>This assignment therefore **permanently disables HTML escaping for every other `Mustache.render()` call in the same Node process** (including `email-service.ts` templates) from the moment any single notification addon (Webhook, Slack legacy, Microsoft Teams, Datadog, New Relic) first formats any event, for the remaining lifetime of the process.</p> <p>`feature-event-formatter-md-events.ts` (`EVENT_MAP`) confirms the blast radius: nearly every event&#39;s `action` template interpolates attacker-controlled values with single-mustache (intended-to-be-escaped) syntax, most importantly `{{user}}`, which is `event.createdBy` — the acting account&#39;s `username` (or `email` if set;…</p> https://db.gcve.eu/vuln/ghsa-w4mq-xh27-6xpx