CVE-2026-76909 Unleash: CR-approval email renders user-controlled raw HTML
Attackers can inject HTML into approval emails, enabling phishing or tracking, affecting Unleash users with email notifications enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-76909?
CVE-2026-76909 is a low-severity cross-site scripting vulnerability in unleash, published on 22 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML escaping, and sendRequestedCRApprovalEmail passes those values to Mustache rendering. A project member who can create a change request when approval emails are enabled can inject HTML into an approver's notification, allowing forged links, tracking content, or visually altered email content. This issue is fixed in version 8.0.3.
Weakness: CWE-79
Which versions are affected by CVE-2026-76909?
2 open source packages ship an affected version, including unleash-server.
| Package | Affected | Fixed in |
|---|---|---|
unleash-server npm | All versions | 8.0.3 |
unleash-server npm | All versions | 8.0.3 |
How do I fix CVE-2026-76909?
Upgrade unleash-server to 8.0.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-76909 being exploited?
There is no known exploitation of CVE-2026-76909 in the wild and no public exploit code.
Sources
Also known as GHSA-7hvx-28gp-mf6j, MINI-37xr-34vh-v5cg.