{"id":"CVE-2026-76909","aliases":["GHSA-7hvx-28gp-mf6j"],"url":"https://o3.security/vulnerability/CVE-2026-76909","summary":"Unleash: CR-approval email renders user-controlled raw HTML","details":"### Summary\nThe change-request approval HTML email template renders fields as raw HTML. User who can create a change request can inject HTML into approval notification emails. I was not able to confirm Enterprise platform is using vulnerable code nor that it doesn't sanitize input.\n\n### Details\n`src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache` uses Mustache triple-stash syntax for fields that can originate from users:\n\n```mustache\n{{{ changeRequestTitle }}}\n{{{ requesterName }}}\n{{{ requesterEmail }}}\n{{{ changeRequestLink }}}\n```\n\nTriple-stash disables HTML escaping even when Mustache's global escape function is safe. The related renderer is `sendRequestedCRApprovalEmail` in `src/lib/services/email-service.ts`, which renders the template with `Mustache.render`.\n\n### PoC\n1. Use an Enterprise deployment with change requests and approval emails enabled.\n2. As a project member who can create change requests, set a display name or change-request title to HTML such as:\n\n```html\n</a><a href=\"https://example.com\">Approve change request</a>\n```\n\n3. Create a change request that requires approval.\n4. Observe that the approval email contains attacker-controlled raw HTML instead of escaped text.\n\n### Impact\nChange-request approvers can receive forged links, tracking pixels, or visually altered email content.","published":"2026-09-22T20:18:25.219Z","modified":"2026-10-21T02:59:45.192437981Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"unleash-server","fixedVersion":"8.0.3"}],"fix":{"url":"https://github.com/Unleash/unleash/commit/7c89cedcbbb5aa826951373569930e0a3c4358db","label":"Unleash/unleash@7c89ced"},"references":[{"type":"WEB","url":"https://github.com/Unleash/unleash/releases/tag/v8.0.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76909.json"},{"type":"ADVISORY","url":"https://github.com/Unleash/unleash/security/advisories/GHSA-7hvx-28gp-mf6j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76909"},{"type":"FIX","url":"https://github.com/Unleash/unleash/commit/7c89cedcbbb5aa826951373569930e0a3c4358db"},{"type":"PACKAGE","url":"https://github.com/Unleash/unleash"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:59:45.192437981Z"}}