Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache render…
Info
Summary
Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML escaping, and sendRequestedCRApprovalEmail passes those values to Mustache rendering. A project member who can create a change request when approval emails are enabled can inject HTML into an approver's n…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/Unleash/unleash/commit/7c89cedcbbb5aa826951373569930e0a3c4358db
- https://github.com/Unleash/unleash/releases/tag/v8.0.3
- https://github.com/Unleash/unleash/security/advisories/GHSA-7hvx-28gp-mf6j
Timeline
- nvd_ingest NVD