CVE-2026-27645CWE-79

changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response

Medium · published February 25, 2026

CVSS v3.1
6.1
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. Version 0.54.1 contains a fix for the issue.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00501 · 42.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-25T04:06Z
EPSS history
Timeline
  • 25 FEB 04:06Z
    changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
    cvelistv5