CVE-2026-27645: dgtlmoon changedetection.io Cross-site Scripting
Vulnerability summary
CVE-2026-27645 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in dgtlmoon changedetection.io. EPSS estimates a 0.50% chance of exploitation in the next 30 days, higher than 42% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 25-02-2026PublishedVulnerability first disclosed.
- 25-02-2026Last modifiedVulnerability information updated.
Description
changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. Version 0.54.1 contains a fix for the issue.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · PypiEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.50%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
+0.06 pp
From 0.45% on 22-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundChangedetection.Io
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Dgtlmoon1 product
- changedetection.io< 0.54.1
PyPI1 product
- changedetection-io< 0.53.7 | < 0.54.1
Webtechnologies1 product
- changedetection< 0.54.1
3 vendors · 3 products
References
4 links- github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-mw8m-398g-h89wX Refsource CONFIRMWEBEVIDENCEExploitVendor Advisory
- github.com/dgtlmoon/changedetection.io/commit/a385c89abf44b52fcfa20c7c6a6dd3047c4c1eb5X Refsource MISCWEBFIXPatch
