Technical impact
The vulnerability involves the Mustache template engine used by Unleash. Prior to version 8.0.3, the FeatureEventFormatterMd.format function assigns Mustache.escape to an identity function, which disables escaping for all subsequent Mustache.render calls. This manipulation represents CWE-116: Improper Encoding or Escaping because the application globally disables the default escaping function. An editor‑level user can set a username containing Slack or Microsoft Teams link syntax. When a feature event is logged, the unescaped username propagates into email, webhook, Datadog and New Relic notifications, allowing an attacker to inject a malicious link that the receiver assumes is legitimate.
Affected Systems
The affected product is Unleash, the open‑source feature management platform. All releases before 8.0.3 are vulnerable because FeatureEventFormatterMd.format assigns Mustache.escape globally. The impact is especially relevant in instances where notifications are sent to trusted channels such as Slack or Teams, as the injected link appears within an authorized message stream.
Risk and Exploitability
The CVSS score is 4.1, indicating a medium impact. With no EPSS data available, the likelihood of public exploitation appears low, which is consistent with the KEV status of not being listed. The vulnerability requires privileged editor rights; therefore, the attack surface is limited to organizations that grant such access. Exploitability is further reduced by the temporary state of Mustache.escape, which remains disabled until the application is restarted after the exploit.
Github GHSA