From b7d2f3664e005aba6e4df14eb73dc3f2e622f5a2 Mon Sep 17 00:00:00 2001
From: Antonella Sgarlatta <anto@standardnotes.com>
Date: Fri, 2 Oct 2026 15:30:36 -0300
Subject: [PATCH] fix: Prevents path injection on unsubscribe

---
 packages/api-gateway/src/Controller/v1/ActionsController.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/api-gateway/src/Controller/v1/ActionsController.ts b/packages/api-gateway/src/Controller/v1/ActionsController.ts
index 44aaada08..7f455a1b1 100644
--- a/packages/api-gateway/src/Controller/v1/ActionsController.ts
+++ b/packages/api-gateway/src/Controller/v1/ActionsController.ts
@@ -51,7 +51,7 @@ export class ActionsController extends BaseHttpController {
     await this.serviceProxy.callEmailServer(
       request,
       response,
-      `subscriptions/actions/unsubscribe/${request.params.token}`,
+      `subscriptions/actions/unsubscribe/${encodeURIComponent(request.params.token)}`,
       request.body,
     )
   }