XSS in Unleash
CVE-2026-76909
Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML escaping, and sendRequestedCRApprovalEmail passes those values to Mustache rendering. A project member who can create a change request when approval emails are enabled can inject HTML into an approver's notification, allowing forged links, tracking content, or visually altered email content. This issue is fixed in version 8.0.3.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
EPSS exploit prediction
EPSS: 0.005 (40.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 41st percentile — 40.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.002
Affected products
- Unleash — versions < 8.0.3