CVE-2026-29038: changedetection.io Reflected XSS Vulnerability in RSS Tag Endpoint
Summary
CVE-2026-29038: changedetection.io has Reflected XSS in its RSS Tag Error Response. Affects changedetection-io versions < 0.54.4. Fixed in 0.54.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
changedetection.io is an open-source tool designed to monitor changes on web pages and notify users of updates. It provides features such as RSS feeds for tracking changes, allowing users to customize their monitoring experience. However, a reflected cross-site scripting (XSS) vulnerability has been identified in the '/rss/tag/' endpoint, which can lead to serious security issues if exploited.
Vulnerability Detail
The vulnerability arises from the improper handling of the 'tag_uuid' path parameter in the '/rss/tag/' endpoint. This parameter is reflected directly in the HTTP response body without proper HTML escaping, allowing attackers to inject malicious JavaScript. When a user accesses a crafted URL, the browser executes the injected script, potentially leading to session cookie theft, account takeover, and phishing attacks. The vulnerability exists in version 0.54.1, which did not address this issue despite fixing a similar vulnerability in another endpoint.
How To Fix
Latest published version: 0.60.9 as of 22 Oct 2026
pip install --upgrade "changedetection-io==0.60.9"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.54.4
This is the first release that contains the fix.
pip install --upgrade "changedetection-io==0.54.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can set the Content-Type of the response to 'text/plain' to prevent the execution of injected scripts. Here is an example code snippet:
from flask import make_response
if not tag: resp = make_response(f"Tag with UUID {tag_uuid} not found", 404) resp.headers['Content-Type'] = 'text/plain; charset=utf-8'
return resp
Conclusion
The reflected XSS vulnerability in changedetection.io's '/rss/tag/' endpoint poses a significant security risk, allowing attackers to execute malicious scripts. Users are advised to monitor for updates and implement temporary workarounds until a patch is available.
See every vulnerability recorded for changedetection-io →
FAQ
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential impacts include session cookie theft, account takeover, and phishing attacks, as attackers can execute JavaScript in the context of the victim's session.
Currently, there is no patched version available. Users should monitor the package repository for updates.
changedetection.io is used to monitor changes on web pages and notify users of updates via customizable RSS feeds.
References
Related vulnerabilities
Recent vulnerabilities recorded for changedetection-io.
