CVE-2024-32651: changedetection.io Critical Server Side Template Injection Vulnerability
Summary
CVE-2024-32651: A Server Side Template Injection in changedetection.io caused by usage of unsafe functions of Jinja2 allows Remote Command Execution on the server host. Affects changedetection-io versions < 0.45.21. Fixed in 0.45.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
changedetection.io is an open-source application designed to monitor changes in web pages and notify users of updates. It utilizes the Jinja2 template engine for rendering notifications. The application is widely used for its simplicity and effectiveness in tracking website changes. However, it has a critical vulnerability that arises from improper handling of user input in Jinja2 templates, making it susceptible to Server Side Template Injection (SSTI).
Vulnerability Detail
The vulnerability in changedetection.io is a Server Side Template Injection (SSTI) caused by the use of unsafe functions in the Jinja2 template engine. This flaw allows attackers to execute arbitrary commands on the server. The issue originates from the way notification bodies and titles are rendered using user-provided input without proper sanitization. Attackers can exploit this vulnerability by injecting malicious payloads into the notification fields, leading to potential remote command execution. The impact is severe, as it allows complete control over the server host, enabling attackers to run any system command without restrictions.
How To Fix
Latest published version: 0.60.9 as of 22 Oct 2026
pip install --upgrade "changedetection-io==0.60.9"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.45.21
This is the first release that contains the fix.
pip install --upgrade "changedetection-io==0.45.21"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can protect access to the changedetection.io application by implementing a login page with a password. This is not enforced by default, but adding authentication can help mitigate unauthorized access until the application is updated.
Conclusion
The CVE-2024-32651 vulnerability in changedetection.io represents a critical security risk due to its Server Side Template Injection flaw. Users are strongly advised to update to the latest version to mitigate this risk. Implementing access controls can provide temporary relief until the update is applied. Regular monitoring for vulnerabilities using tools like Vulert is recommended to maintain security.
See every vulnerability recorded for changedetection-io →
FAQ
SSTI is a type of vulnerability that occurs when an application allows untrusted input to be rendered as a template on the server side, potentially allowing attackers to execute arbitrary code.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without any signup.
The consequences can be severe, including complete server takeover, unauthorized access to sensitive data, and the ability to execute any command on the server.
Yes, implementing a password-protected login page can help limit access to the application and reduce the risk of exploitation until an update can be applied.
If you suspect a compromise, immediately disconnect the server from the network, investigate the logs for unauthorized access, and consider restoring from a secure backup.
Related vulnerabilities
Recent vulnerabilities recorded for changedetection-io.
