CVE-2026-27645 Details
Description
changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. Version 0.54.1 contains a fix for the issue.
A reflected cross-site scripting vulnerability has been identified in changedetection.io, a web page change detection tool, in versions prior to 0.54.1. The issue arises in the RSS single-watch endpoint, which reflects the UUID path parameter directly in the HTTP response body without proper HTML escaping. This flaw allows injected JavaScript to be executed in the context of the user's session. The vulnerability was confirmed on version 0.53.6 and affects several instances in the wild.
Users are advised to update to changedetection.io version 0.54.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-mw8m-398g-h89w | CISA-ADP | ExploitVendor Advisory |
| https://github.com/dgtlmoon/changedetection.io/commit/a385c89abf44b52fcfa20c7c6a6dd3047c4c1eb5 | [email protected] | Patch |
| https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-mw8m-398g-h89w | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| webtechnologies changedetection | < 0.54.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | Initial Analysis | [email protected] |
| Feb 25, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | New CVE Received | [email protected] |