CVE-2025-62780: changedetection.io Stored XSS Vulnerability in Watch Update API
Summary
CVE-2025-62780: changedetection.io: Stored XSS in Watch update via API. Affects changedetection-io versions < 0.50.34. Fixed in 0.50.34. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
changedetection.io is an open-source tool designed to monitor changes in web pages. It allows users to track updates on specific URLs and receive notifications when changes occur. The application provides a user-friendly interface for managing watches, but it has a vulnerability that can be exploited through its API, specifically when updating watch URLs.
Vulnerability Detail
The vulnerability arises from a Stored Cross Site Scripting (XSS) flaw in the changedetection.io Watch update API due to insufficient security checks. While the UI has protections against unsafe URLs, the API does not enforce these checks, allowing attackers to insert malicious JavaScript payloads into watch URLs. This can lead to the execution of arbitrary scripts in the context of the user's browser, potentially compromising user data and session integrity.
How To Fix
Latest published version: 0.60.9 as of 22 Oct 2026
pip install --upgrade "changedetection-io==0.60.9"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.50.34
This is the first release that contains the fix.
pip install --upgrade "changedetection-io==0.50.34"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the Watch update API to add or modify URLs until the package is updated. Instead, use the web interface, which has the necessary validations in place.
Conclusion
The stored XSS vulnerability in the changedetection.io Watch update API poses a risk to users by allowing the injection of malicious scripts through unsafe URLs. Users are advised to update to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for changedetection-io →
FAQ
The vulnerability is a Stored Cross Site Scripting (XSS) issue that allows attackers to inject malicious scripts into watch URLs via the API.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors for open-source vulnerabilities without requiring signup.
If exploited, this vulnerability can lead to unauthorized script execution in users' browsers, potentially compromising sensitive information and user sessions.
Yes, the vulnerability has been patched in version 0.50.34 of changedetection.io. Users should upgrade to this version or later.
The CVSS score for this vulnerability is 3.5, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for changedetection-io.
