CVE-2026-29038: dgtlmoon changedetection.io Cross-site Scripting
Vulnerability summary
CVE-2026-29038 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in dgtlmoon changedetection.io. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 06-03-2026PublishedVulnerability first disclosed.
- 09-03-2026Last modifiedVulnerability information updated.
Description
changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting (XSS) vulnerability identified in the /rss/tag/ endpoint of changedetection.io. The tag_uuid path parameter is reflected directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. This issue has been patched in version 0.54.4.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · PypiEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.35%
Chance of exploitation in the next 30 days
Percentile
27%
Versus all other CVEs
30-day change
+0.07 pp
From 0.28% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundChangedetection.Io
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Dgtlmoon1 product
- changedetection.io< 0.54.4
PyPI1 product
- changedetection-io< 0.54.4
Webtechnologies1 product
- changedetection< 0.54.4
3 vendors · 3 products
References
6 links- github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-8whx-v8qq-pq64X Refsource CONFIRMWEBEVIDENCEExploitMitigationVendor Advisory
- github.com/dgtlmoon/changedetection.io/commit/ec7d56f85d1e9690fca7cb4711c1fb20dffec780X Refsource MISCWEBFIXPatch
- github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4X Refsource MISCWEBAdvisoryProductRelease Notes
