CyberRota Analysis
AI-GeneratedThe vulnerability affects the Unleash open-source feature management platform, specifically in versions prior to 8.0.3, where user-controlled values in the change-request approval email template are not properly HTML-escaped. This allows project members to inject malicious HTML into approval notifications, potentially leading to phishing attacks or content manipulation. Organizations using affected versions should prioritize updating to 8.0.3 to mitigate the risk of email-based exploits.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML escaping, and sendRequestedCRApprovalEmail passes those values to Mustache rendering. A project member who can create a change request when approval emails are enabled can inject HTML into an approver's notification, allowing forged links, tracking content, or visually altered email content. This issue is fixed in version 8.0.3.