Description
changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. Version 0.54.1 contains a fix for the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dgtlmoon | changedetection.io | < 0.54.1 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Changedetection.io RSS Single Watch - Cross-Site Scripting http/cves/2026/CVE-2026-27645.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | changedetection-io | < 0.53.7 | 0.53.7 | GHSA-mw8m-398g-h89w |
| PyPI | changedetection-io | < 0.54.1 | 0.54.1 | PYSEC-2026-2125 |