CVE-2026-33981CWE-200

Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters

High · published March 27, 2026

CVSS v4.0
8.3
EPSS
1%
Percentile
42.1
In the wild
Unconfirmed
What it is

changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include filter expressions allow use of the jq `env` builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user (or unauthenticated user when no password is set, the default) can leak sensitive environment variables including `SALTED_PASS`, `PLAYWRIGHT_DRIVER_URL`, `HTTP_PROXY`, and any secrets passed as env vars to the container. Version 0.54.7 patches the issue.

The record
Technical detail
CVSS v4.0
8.3 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00502 · 42.1th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-03-27T22:01Z
EPSS history
Timeline
  • 27 MAR 22:01Z
    Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
    cvelistv5