CVE-2026-63466: CVE-2026-63466: Process-Wide Security Degradation via Global Module Mutation in Unleash

#security #cve #cybersecurity

CVE-2026-63466: Process-Wide Security Degradation via Global Module Mutation in Unleash

Vulnerability ID: CVE-2026-63466
CVSS Score: 4.1
Published: 2026-08-21

Prior to version 8.0.3, Unleash's Markdown event formatter directly mutated the global template-escaping function of the shared mustache Node.js module, resulting in a process-wide security degradation where HTML/Markdown escaping was permanently disabled for the application lifetime.

TL;DR

Unleash mutated a global mustache instance, permanently disabling HTML escaping process-wide after any markdown formatting event.

Technical Details

CWE ID: CWE-116 / CWE-1188
Attack Vector: Network
CVSS Score: 4.1
EPSS Score: N/A
Impact: Process-wide HTML/Markdown escaping bypass
Exploit Status: None
KEV Status: Not Listed

Affected Systems

Unleash Core Server
Unleash Enterprise Backend
Unleash Core & Enterprise Backend: < 8.0.3 (Fixed in: 8.0.3)

Code Analysis

Commit: 002012c

Fix process-wide mustache escape pollution by passing local rendering context instead of overwriting global singleton callback

@@ -354,11 +354,10 @@ export class FeatureEventFormatterMd implements FeatureEventFormatter {
             ...formatting,
         };

-        Mustache.escape = (text) => text;
-
-        const text = Mustache.render(action, context);
+        const renderContext = { escape: (text: string) => text };
+        const text = Mustache.render(action, context, undefined, renderContext);
         const url = path
-            ? `${this.unleashUrl}${Mustache.render(path, context)}`
+            ? `${this.unleashUrl}${Mustache.render(path, context, undefined, renderContext)}`
             : undefined;

         return {...

Mitigation Strategies

Upgrade Unleash instances to version 8.0.3 or higher.
Implement boundary input validation on user-configurable fields like names and emails.

Remediation Steps:

Identify current Unleash version in deployment package.json or container tags.
Update the Unleash package to v8.0.3 or pull Docker tag 'unleash-org/unleash:8.0.3'.
Deploy the updated codebase and trigger a full restart of all Unleash server processes.
Verify that custom username attributes containing markdown format characters are properly escaped in test alert channels.

References

Read the full report for CVE-2026-63466 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community