Skip to content
OpenAdvisories
High · 8.3 CVE-2026-33981 EUVD-2026-16880GHSA-58r7-4wr5-hfx8PYSEC-2026-2130

Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters

Published Mar 27, 2026 · Updated Mar 30, 2026 · Assigned by GitHub_M

Description

changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include filter expressions allow use of the jq `env` builtin, which reads all process environment variables and stores them as the watch snapshot. An authenticated user (or unauthenticated user when no password is set, the default) can leak sensitive environment variables including `SALTED_PASS`, `PLAYWRIGHT_DRIVER_URL`, `HTTP_PROXY`, and any secrets passed as env vars to the container. Version 0.54.7 patches the issue.

Affected products

VendorProductAffectedFixed
dgtlmoon changedetection.io < 0.54.7 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI changedetection-io < 0.54.7 0.54.7 GHSA-58r7-4wr5-hfx8

References