A user with permissions to create change requests in Unleash can inject unescaped HTML, requester information, and change request titles into the approval email template. The injected content is rendered directly in the recipient’s mailbox, allowing forged links, tracking pixels, or altered visual appearance. The vulnerability resides in the mustache template rendering without escaping user input and is not a remote code execution flaw, but it enables the sender to manipulate the email content seen by approvers.

Unleash feature management platform, any version earlier than 8.0.3. The issue is mitigated in release 8.0.3, which adds HTML escaping for the change request title, requester name, and requester email fields within the approval notification template.

The CVSS score of 2.1 indicates low overall risk, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have legitimate project‑member rights to create a change request with arbitrary title text. The attack vector thus is through the internal change‑request workflow rather than an externally reachable input, but an exploited email could be used for social engineering by the approver or other recipients.