Skip to content
OpenAdvisories
Critical · 10.0 Scanner template Public exploit CVE-2024-32651 EUVD-2024-2939GHSA-4r7v-whpg-8rx3PYSEC-2026-310

Server Side Template Injection in Jinja2 allows Remote Command Execution

Published Apr 25, 2024 · Updated Feb 13, 2025 · Assigned by GitHub_M

Vendor: dgtlmoon Product: changedetection.io Package: changedetection-io Ecosystem: PyPI

Description

changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).

Affected products

VendorProductAffectedFixed
dgtlmoon changedetection.io <= 0.45.20 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI changedetection-io < 0.45.21 0.45.21 GHSA-4r7v-whpg-8rx3

References