Homepage

Improper Encoding or Escaping of Output Affecting unleash-server package, versions <8.0.3-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.18% (9th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-UNLEASHSERVER-19232274
  • published23 Aug 2026
  • disclosed21 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 21 Aug 2026

NewCVE-2026-63466  (opens in a new tab)
CWE-116  (opens in a new tab)

How to fix?

Upgrade Minimos:latest unleash-server to version 8.0.3-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream unleash-server package and not the unleash-server package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

Unleash is an open-source feature management platform. Prior to 8.0.3, FeatureEventFormatterMd.format in src/lib/addons/feature-event-formatter-md.ts assigns Mustache.escape to an identity function before rendering action and path templates. Because Mustache.escape is process-wide, the assignment disables escaping for subsequent Mustache.render calls in email-service.ts, webhook.ts, datadog.ts, and new-relic.ts. An editor-level user can place Slack or Microsoft Teams link syntax in an unrestricted username, trigger a feature event, and inject an attacker-labeled link into a trusted outbound notification channel, while other Mustache sinks remain unescaped until restart. This issue is fixed in version 8.0.3.