CVE-2026-92814 Details

A cross-site scripting vulnerability has been identified in changedetection.io versions through 0.60.6. The issue arises because the application fails to properly escape scraped page titles before sending HTML notifications. This oversight allows attackers to inject arbitrary markup into monitored page titles, which is then delivered as live content through notification channels such as email and Telegram, particularly when the watch_title token is included in the notification templates.

The vulnerability can be addressed by adding the watch_title and watch_tag to the escaped-key set in the notification handler, or by HTML-escaping the watch.label when creating the notification parameters. Another approach is to modify the Jinja2 rendering environment to autoescape HTML notification formats, eliminating the need for a manual allowlist.