Repository navigation
Security: Unleash/unleash
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
SSO auto-provisioning email domain allowlist bypassable via unanchored suffix match (Enterprise)GHSA-w76w-g38w-vrq7 published
Sep 8, 2026 by alexantoModerate -
Cross-project IDOR lets a project member overwrite any feature's environment variants and payloadsGHSA-639f-52mg-grrc published
Sep 8, 2026 by alexantoHigh -
Cross-project overwrite of feature-flag variants via `variants-batch` (feature not bound to path project)GHSA-v6pr-g426-4xc4 published
Sep 8, 2026 by alexantoHigh -
cross-project IDOR on feature-dependency routes: the child/parent feature is never checked against the URL projectGHSA-fpj2-2j3q-2gq8 published
Sep 8, 2026 by alexantoHigh -
Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headersGHSA-5vf6-jrqr-78fj published
Jul 1, 2026 by chriswkModerate -
A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit logGHSA-5ffh-6f9q-5hhr published
Jul 13, 2026 by chriswkModerate -
Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted usernameGHSA-w4mq-xh27-6xpx published
Jul 10, 2026 by chriswkModerate -
Unauthenticated single-request DoS via OpenAPI validation error formatterGHSA-r5pq-6chh-j3xp published
Jul 1, 2026 by chriswkHigh -
CR-approval email renders user-controlled raw HTMLGHSA-7hvx-28gp-mf6j published
Jul 10, 2026 by chriswkLow -
Clone-feature lets a user copy a feature from a project they cannot readGHSA-8xcj-9hfr-fh9j published
Jul 10, 2026 by chriswkModerate
Learn more about advisories related to Unleash/unleash in the GitHub Advisory Database