CVE-2026-63466

Medium

Advisory

Published 21 Aug 2026In the index since 6 Sept 2026

Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
unleash-servernpm	7.5.0	8.0.3	2

2 by stars

Chart

Latest

Affected images

Radar Score

1 of the 2 container images this version deploys carry CVE-2026-63466.

Container image	Digest	Package	Fixed in
unleashorg/unleash-server :7.5.0	9adb37e399ba	unleash-server@7.5.0	8.0.3

2,059

1 of the 1 container images this version deploys carry CVE-2026-63466.

Container image	Digest	Package	Fixed in
unleashorg/unleash-enterprise :7.5.0	245aeba40053	unleash-server@7.5.0	8.0.3

2,028

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
unleashorg/unleash-enterprise :7.5.0	245aeba40053	unleash-server@7.5.0	8.0.3	1
unleashorg/unleash-server :7.5.0	9adb37e399ba	unleash-server@7.5.0	8.0.3	1