CVE-2026-29038 Details
Description
changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting (XSS) vulnerability identified in the /rss/tag/ endpoint of changedetection.io. The tag_uuid path parameter is reflected directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. This issue has been patched in version 0.54.4.
A reflected cross-site scripting vulnerability has been identified in changedetection.io versions prior to 0.54.4. The issue resides in the RSS tag endpoint, where the tag_uuid path parameter is echoed in the response without proper HTML escaping. This flaw allows browsers to execute injected JavaScript, as Flask defaults to text/html for unescaped string responses. The vulnerability can be exploited by extracting a valid RSS token from the homepage and using it to craft a malicious link that, when clicked, executes the JavaScript in the context of the user's session.
Users can update to changedetection.io version 0.54.4, which addresses this vulnerability by properly escaping the tag_uuid parameter before including it in the response.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dgtlmoon/changedetection.io/commit/ec7d56f85d1e9690fca7cb4711c1fb20dffec780 | [email protected] | Patch |
| https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4 | [email protected] | ProductRelease Notes |
| https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-8whx-v8qq-pq64 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| webtechnologies changedetection | < 0.54.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | New CVE Received | [email protected] |