CVE-2026-76909: Unleash: CR-approval email renders user-controlled raw HTML

September 22, 2026

The change-request approval HTML email template renders fields as raw HTML. User who can create a change request can inject HTML into approval notification emails. I was not able to confirm Enterprise platform is using vulnerable code nor that it doesn’t sanitize input.

References

github.com/Unleash/unleash/commit/7c89cedcbbb5aa826951373569930e0a3c4358db
github.com/Unleash/unleash/releases/tag/v8.0.3
github.com/Unleash/unleash/security/advisories/GHSA-7hvx-28gp-mf6j
github.com/advisories/GHSA-7hvx-28gp-mf6j
nvd.nist.gov/vuln/detail/CVE-2026-76909

Code Behaviors & Features

Detect and mitigate CVE-2026-76909 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →