{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.53.6"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "changedetection.io"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.53.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27645"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-25T19:07:44Z",
    "nvd_published_at": "2026-02-25T05:17:26Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThree security vulnerabilities were identified in [changedetection.io](http://changedetection.io/) through source code review and live validation against a locally deployed Docker instance. All vulnerabilities were confirmed exploitable on the latest version (0.53.6) it was additionally validated at scale against 500 internet-facing instances discovered via FOFA search engine, producing 5K+ confirmed detections using a custom Nuclei template, demonstrating widespread real-world impact.\nThe RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript.\n\n### Details\nFile: `changedetectionio/blueprint/rss/single_watch.py (lines ~45 and ~50)`\n\nThe UUID parameter from the URL path is interpolated into the response body using an f-string with no escaping:\n\n### Line ~45\n```\nwatch = datastore.data[\u0027watching\u0027].get(uuid)\nif not watch:\n    return f\"Watch with UUID {uuid} not found\", 404  # \u2190 No escaping, Content-Type: text/html\n```\n\n### Line ~50\n```\nif len(dates) \u003c 2:\n    return f\"Watch {uuid} does not have enough history snapshots...\", 400  # \u2190 Same issue\nFlask\u0027s default Content-Type for plain string responses is text/html; charset=utf-8, so any HTML/JavaScript in {uuid} is rendered by the browser.\n```\n\n## Attack Vector\nThe attack requires a valid RSS access token, which is a 32-character hex string exposed in the HTML \u003clink\u003e tag on the homepage without authentication:\n\n\u003c!-- Visible in page source of any unauthenticated instance --\u003e\n\u003clink rel=\"alternate\" type=\"application/rss+xml\" href=\"/rss?token=f2bb14e20ff01bad83a743cf21b5df95\"\u003e\n\nAttacker visits the target\u0027s homepage if it unauthenticathed and extracts the RSS token from the \u003clink\u003e tag\nCrafts a malicious URL:\n\n1. http://target:5000/rss/watch/%3Cimg%20src%3Dx%20onerror%3Dalert(document.cookie)%3E?token=EXTRACTED_TOKEN\n2. Sends the link to a victim who has an active session on the [changedetection.io](http://changedetection.io/) instance\n3. When the victim clicks the link, the server responds with:\n4. Watch with UUID not found\n\nThe browser renders the \u003cimg\u003e tag, the onerror fires, and JavaScript executes in the victim\u0027s session context\n\n### PoC\nRequest:\n\n```\nGET /rss/watch/%3Cimg%20src%3Dx%20onerror%3Dalert(document.cookie)%3E?token=223e7edbbfee2268f5abb5344919054e HTTP/1.1\nHost: [127.0.0.1:5000](http://127.0.0.1:5000/)\n```\n\nResponse:\n\n```\nHTTP/1.1 404 NOT FOUND\nContent-Type: text/html; charset=utf-8\n```\n\nWatch with UUID not found\n\n\n\u003cimg width=\"1918\" height=\"1032\" alt=\"image\" src=\"https://github.com/user-attachments/assets/1633b167-e4ec-4705-a110-18fad7826fc9\" /\u003e\n\nThe XSS payload is reflected unescaped in an HTML response. The browser executes alert(document.cookie).\n\nLots of intances over internet affected to this.\n\u003cimg width=\"1465\" height=\"721\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f54160d4-abd1-4e8d-b845-f85e53e79325\" /\u003e\n\n\n### Impact\n- Session cookie theft via document.cookie exfiltration\n- Account takeover if session cookies lack HttpOnly flag\n- Phishing via crafted links that appear to originate from a trusted [changedetection.io](http://changedetection.io/) instance\n- Token is obtainable without authentication from the homepage \u003clink\u003e tag, lowering the barrier to exploitation\n\nchangedetection.io can work with developer teams to validate and address these issues. Please confirm receipt of this report and inform changedetection.io of the preferred timeline for coordinating the fix.\n\nRoberto Nunes",
  "id": "GHSA-mw8m-398g-h89w",
  "modified": "2026-02-25T19:07:44Z",
  "published": "2026-02-25T19:07:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-mw8m-398g-h89w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27645"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dgtlmoon/changedetection.io/commit/a385c89abf44b52fcfa20c7c6a6dd3047c4c1eb5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dgtlmoon/changedetection.io"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response"
}