{"action":"Upgrade unleash-server to 8.0.3 or later.","affected":[{"fixed":"8.0.3","introduced":"0"}],"component":"unleash-server","cve_ids":["CVE-2026-63466"],"ecosystem":"npm","epss":0.00319,"exploited":false,"fixed_versions":["8.0.3"],"ghsa_id":"GHSA-w4mq-xh27-6xpx","id":"tcs_01M5KGDWYPHNNBDCQS91CNF9V0","modified_at":"2026-08-21T19:40:58.377206Z","published_at":"2026-08-21T19:14:52Z","references":["https://osv.dev/vulnerability/GHSA-w4mq-xh27-6xpx","https://github.com/Unleash/unleash/security/advisories/GHSA-w4mq-xh27-6xpx","https://github.com/Unleash/unleash/commit/002012cfdbedd2e9b7db9dc83b9f549f761db22e","https://github.com/Unleash/unleash","https://github.com/Unleash/unleash/releases/tag/v8.0.3"],"severity":{"label":"medium","score":4.1},"sources":[{"source":"osv","source_id":"GHSA-w4mq-xh27-6xpx","url":"https://osv.dev/vulnerability/GHSA-w4mq-xh27-6xpx"}],"summary":"Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username"}