CVE-2026-76909: Unleash: CR-approval email renders user-controlled raw HTML

September 22, 2026

The change-request approval HTML email template renders fields as raw HTML. User who can create a change request can inject HTML into approval notification emails. I was not able to confirm Enterprise platform is using vulnerable code nor that it doesn’t sanitize input.

References

github.com/Unleash/unleash/commit/7c89cedcbbb5aa826951373569930e0a3c4358db
github.com/Unleash/unleash/releases/tag/v8.0.3
github.com/Unleash/unleash/security/advisories/GHSA-7hvx-28gp-mf6j
github.com/advisories/GHSA-7hvx-28gp-mf6j
nvd.nist.gov/vuln/detail/CVE-2026-76909

Code Behaviors & Features

Detect and mitigate CVE-2026-76909 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →