CVE-2026-33981 Details
Description
changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include filter expressions allow use of the jq `env` builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user (or unauthenticated user when no password is set, the default) can leak sensitive environment variables including `SALTED_PASS`, `PLAYWRIGHT_DRIVER_URL`, `HTTP_PROXY`, and any secrets passed as env vars to the container. Version 0.54.7 patches the issue.
A vulnerability in changedetection.io prior to version 0.54.7 allows for the unauthorized disclosure of environment variables. The issue arises from the 'jq:' and 'jqraw:' include filter expressions, which permit the use of the jq 'env' built-in. This built-in reads all process environment variables and includes them in the watch snapshot. An authenticated user, or an unauthenticated user when no password is set (the default), can exploit this vulnerability to access sensitive environment variables such as 'SALTED_PASS', 'PLAYWRIGHT_DRIVER_URL', 'HTTP_PROXY', and any other secrets passed as environment variables to the container.
Users can update to changedetection.io version 0.54.7 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-58r7-4wr5-hfx8 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/dgtlmoon/changedetection.io/commit/65517a9c74a0cbe1a4661314470b28131ef5557f | [email protected] | Patch |
| https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.7 | [email protected] | ProductRelease Notes |
| https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-58r7-4wr5-hfx8 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| webtechnologies changedetection | < 0.54.7 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 2, 2026 | Initial Analysis | [email protected] |
| Mar 30, 2026 | CVE Modified | CISA-ADP |
| Mar 27, 2026 | New CVE Received | [email protected] |