01 Record

CVE-2026-63466

Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

MediumPUBLISHEDCNA: GitHub_M

Base score4.1 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

02 Description

Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

Published

2026-08-21 18:21Z7 HR AGO

Last updated

2026-08-21 21:43Z3 HR AGO

Reserved

2026-07-16

Assigning CNA

GitHub_M

Record state

PUBLISHED

Severity

Medium (CVSS 4.1)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Weaknesses

SSVC decision

ExploitationnoneAutomatablenoTechnical Impactpartial

Data version

5.2

Document digest

60a84e14fb61f54e4818677fd43093cd6c108f4fcf8697b8bad31e71dc7dc5b6

VendorProductVersionsPlatforms

Unleashunleash< 8.0.3—