CVE-2026-27645: changedetection.io Reflected XSS Vulnerability in RSS Single Watch Error Response
Summary
CVE-2026-27645: changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response. Affects changedetection-io versions < 0.53.7. Fixed in 0.53.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
changedetection.io is an open-source web application that monitors changes in web pages and notifies users of updates. It allows users to track specific URLs and receive alerts when changes occur. The application utilizes an RSS feed for notifications, making it easier for users to stay informed. However, a vulnerability has been identified in the RSS single-watch endpoint, which can lead to reflected cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from the RSS single-watch endpoint reflecting the UUID path parameter directly in the HTTP response body without proper HTML escaping. This flaw allows an attacker to inject malicious JavaScript into the response, which is then executed by the victim's browser. The attack requires a valid RSS access token, which is publicly accessible on the homepage, making it easier for attackers to exploit the vulnerability. The potential ramifications include session cookie theft, account takeover, and phishing attacks.
How To Fix
Latest published version: 0.60.9 as of 22 Oct 2026
pip install --upgrade "changedetection-io==0.60.9"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.53.7
This is the first release that contains the fix.
pip install --upgrade "changedetection-io==0.53.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation and output encoding for the UUID parameter in the application code to prevent the execution of injected scripts. For example, modify the response generation to escape HTML characters in the UUID before including it in the response body.
Conclusion
CVE-2026-27645 is a significant vulnerability in changedetection.io that can lead to serious security issues if not addressed. Users are encouraged to update to the latest version to protect against potential exploits. Additionally, implementing proper input validation and output encoding can help mitigate risks until the update is applied.
See every vulnerability recorded for changedetection-io →
FAQ
CVE-2026-27645 is a vulnerability in changedetection.io that allows for reflected cross-site scripting (XSS) attacks through the RSS single-watch endpoint.
If you are using changedetection.io version 0.53.6 or earlier, your instance is vulnerable. You can check your version by running pip show changedetection-io.
The risks include session cookie theft, potential account takeover, and phishing attacks, as attackers can exploit the vulnerability to execute malicious scripts in users' browsers.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground.
The CVSS score for CVE-2026-27645 is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for changedetection-io.
