CVE-2026-92814CWE-79cross-site-scripting

CVE-2026-92814

Medium · published September 17, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
2.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00296 · 21.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-17T01:17Z
References (4)
https://github.com/dgtlmoon/changedetection.io · [email protected]https://github.com/dgtlmoon/changedetection.io/blob/0.60.6/changedetectionio/notification/handler.py#L400-L414 · [email protected]https://github.com/geo-chen/oss/blob/main/changedetection.io.md#finding-1-stored-htmlmarkup-injection-into-html-notifications-via-scraped-page-title-watch_title-not-in-the-escape-set · [email protected]https://www.vulncheck.com/advisories/changedetection-io-through-0.60.6-cross-site-scripting-via-watch-title · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 20:32Z
    changedetection.io through 0.60.6 Cross-Site Scripting via watch_title
    cvelistv5