unleash
v8.3.1Open-source feature management platform
- Maintenance
- Active929 commits in 3 months · bus factor 5
- License
- AGPL-3.0Copyleft · OSI-approved · changed in 2024
- Security
- 16 advisories8 high, 6 medium, 2 low · Scorecard 6.2/10
- Supported versions
- No scheduleendoflife.date does not track this project
14.3k stars · 937 forks · 45 open issues · last release 17 days ago · data checked 3 hours ago
Security advisories
All advisories on GitHubThe 16 most recent advisories published by the maintainers: 8 high, 6 medium, 2 low. Check the patched version against the one you run.
- highGHSA-jhpr-7gr3-xfjgOct 27, 2026Prototype pollution via a feature flag named __proto__ crashes the Unleash server and prevents restart (persistent DoS)
- Affected
- >= 5.11.0, < 8.3.0
- Patched in
- 8.3.0
- mediumGHSA-65r2-v52f-778rOct 27, 2026Cross-project IDOR in Unleash feature links: update/delete/create a feature link by id without binding it to the URL project
- Affected
- < 8.3.0
- Patched in
- 8.3.0
- highGHSA-5c47-jgc3-3gm4Oct 27, 2026Reflected XSS in the admin email-preview endpoint
- Affected
- <8.3.0
- Patched in
- 8.3.0
- highGHSA-36wh-fxff-4h93Oct 27, 2026Race condition in password-reset/invite token allows single-use bypass and silent password overwrite
- Affected
- < 8.3.0
- Patched in
- 8.3.0
- lowGHSA-mc92-wf5j-8pwhOct 27, 2026NAT64 prefix typo + missing Teredo check in isLocalIpv6 allows SSRF guard bypass via IPv6 transition addresses (incomplete fix for GHSA-5vf6)
- Affected
- <8.3.0
- Patched in
- 8.3.0
- mediumGHSA-w76w-g38w-vrq7Sep 8, 2026SSO auto-provisioning email domain allowlist bypassable via unanchored suffix match (Enterprise)
- Affected
- 8.1.0
- Patched in
- 8.2.0
- highGHSA-639f-52mg-grrcSep 8, 2026Cross-project IDOR lets a project member overwrite any feature's environment variants and payloads
- Affected
- <= 8.1.0
- Patched in
- 8.2.0
- highGHSA-v6pr-g426-4xc4Sep 8, 2026Cross-project overwrite of feature-flag variants via `variants-batch` (feature not bound to path project)
- Affected
- <= 8.1.0
- Patched in
- 8.2.0
- highGHSA-fpj2-2j3q-2gq8Sep 8, 2026cross-project IDOR on feature-dependency routes: the child/parent feature is never checked against the URL project
- Affected
- >= 8.0.3, <= <latest release>
- Patched in
- 8.2.0
- highCVE-2026-77426Jul 13, 2026Missing await on permission check + cross-project IDOR in admin API
- Affected
- <= 6.6.0
- Patched in
- 8.0.3
- mediumCVE-2026-77425Jul 13, 2026A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log
- Affected
- <= 8.0.0
- Patched in
- 8.0.3
- mediumCVE-2026-76910Jul 10, 2026Clone-feature lets a user copy a feature from a project they cannot read
- Affected
- <=7.6.4
- Patched in
- 8.0.3
- lowCVE-2026-76909Jul 10, 2026CR-approval email renders user-controlled raw HTML
- Affected
- <=7.6.4
- Patched in
- 8.0.3
- mediumCVE-2026-63466Jul 10, 2026Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username
- Affected
- <= 8.0.1
- Patched in
- 8.0.3
- mediumCVE-2026-63004Jul 1, 2026Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers
- Affected
- <= 8.0.0
- Patched in
- 8.0.4, 7.6.5, 7.5.2
- highCVE-2026-63462Jul 1, 2026Unauthenticated single-request DoS via OpenAPI validation error formatter
- Affected
- <= 8.0.0
- Patched in
- 8.0.4, 7.6.5, 7.5.2