https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 01:53:39 +0000 https://vulnerability.circl.lu/vuln/cve-2026-76909 <p><strong>Affected:</strong> unleash</p> <p>Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML escaping, and sendRequestedCRApprovalEmail passes those values to Mustache rendering. A project member who can create a change request when approval emails are enabled can inject HTML into an approver&#39;s notification, allowing forged links, tracking content, or visually altered email content. This issue is fixed in version 8.0.3.</p> <p><strong>Affected:</strong> unleash</p> <p>Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML escaping, and sendRequestedCRApprovalEmail passes those values to Mustache rendering. A project member who can create a change request when approval emails are enabled can inject HTML into an approver&#39;s notification, allowing forged links, tracking content, or visually altered email content. This issue is fixed in version 8.0.3.</p> https://vulnerability.circl.lu/vuln/cve-2026-76909