Listen to this Post
Intro
The vulnerability exists in the way the FeatureEventFormatterMd class in Unleash handles Mustache template rendering for outgoing notifications. The core issue stems from the mutation of a shared global escape function within the Mustache library, which is used across the entire Node.js process.
Specifically, in the format() method of src/lib/addons/feature-event-formatter-md.ts, the code assigns Mustache.escape = (text) => text;. This assignment is performed to disable escaping, presumably because the formatted output is intended for markdown or raw text. However, the `Mustache` module is a singleton; its `escape` property is a module-level variable that persists for the lifetime of the Node process. Once this assignment is executed, every other `Mustache.render()` call in the application—including those in email-service, webhook, Datadog, and New Relic integrations—will use this disabled escape function.
The attacker-controlled data originates from the `{{user}}` placeholder in the event templates, which is populated by event.createdBy. This value is sourced from extractUsernameFromUser, which uses the user’s `username` or email. The codebase lacks validation for these fields, allowing an attacker to inject special characters like <, >, and |.
When a notification addon (e.g., Webhook, Slack) processes an event, it calls handleEvent(), which triggers the vulnerable `format()` method. This mutates the global escape, rendering the `{{user}}` template without HTML escaping. For Slack integrations, this means raw markdown link syntax (<url|label>) is sent directly to the Slack API and rendered as a clickable link, enabling phishing or other social engineering attacks.
The secondary impact is that this global mutation breaks escaping for all other Mustache renderings, such as email templates, increasing the attack surface. Additionally, custom webhook bodyTemplates that are rendered as JSON can be broken by an attacker-controlled `”` character.
The recommended fix is to use Mustache’s per-call render option (config.escape) to provide a local escape function for these specific renderings, avoiding any mutation of the global state.
DailyCVE Form:
Platform: Unleash
Version: v8.0.1
Vulnerability: Link Injection
Severity: Medium
date: August 22, 2026
Prediction: Unknown
What Undercode Say:
Verify the vulnerability
curl -X POST “http://localhost:4242/api/admin/users” \
-H “Authorization:
-H “Content-Type: application/json” \
-d ‘{“username”:”evilhttps://attacker.com|Click“,”email”:”[email protected]”,”password”:”Test123!”}’
Create a feature flag (Attack Trigger)
curl -X POST “http://localhost:4242/api/admin/projects/default/features” \
-H “Authorization:
-H “Content-Type: application/json” \
-d ‘{“name”:”test-flag”,”type”:”release”,”description”:”test”}’
Observe the webhook payload (vulnerable output)
The ‘createdBy’ field will contain unescaped HTML/URLs
Exploit: (Educational Purposes!)
- Attacker registers as a new user with a payload in the username.
- Attacker performs a write action (e.g., creates a flag).
- The notification addon processes the event, causing the global escape to be disabled.
- The event template is rendered, injecting the attacker’s payload.
- The payload is sent to the notification channel (e.g., Slack) and rendered as a link.
Protection:
- Upgrade to a patched version or apply a hotfix that uses a local escape function.
- Avoid global mutation: `const renderConfig = { escape: (text) => text }; const text = Mustache.render(action, context, undefined, renderConfig);`
3. Implement input validation on the username/email fields to disallow<,>,|, and".
Impact:
- Phishing attacks via trusted notification channels.
- Cross-site scripting (XSS) in webhook/email contexts.
- JSON structure injection and potential data corruption in webhook bodies.
- Widespread impact due to the global singleton nature of the vulnerability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
