CVE-2023-24769 Stored cross site scripting in changedetection.io
Attackers can execute arbitrary scripts via stored XSS in the URL parameter of the change detection watch function.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-24769?
CVE-2023-24769 is a medium-severity cross-site scripting vulnerability in n/a, published on 17 Feb 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter under the "Add a new change detection watch" function.
Weakness: CWE-79
Which versions are affected by CVE-2023-24769?
3 open source packages ship an affected version, including changedetection-io and changedetection.io. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
changedetection-io PyPI | All versions | 0.40.1.1 |
changedetection-io PyPI | All versions | 0.40.2 |
changedetection.io PyPI | All versions | 0.40.2 |
Products include Webtechnologies Changedetection.
How do I fix CVE-2023-24769?
Upgrade changedetection-io to a fixed version for your release line: 0.40.1.1 or 0.40.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-24769 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-24769 exists.
Other vulnerabilities in n/a
- CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering
- CVE-2026-29039 changedetection.io: XPath - Arbitrary File Read via unparsed-text()
- CVE-2026-29065 changedetection.io: Zip Slip vulnerability in the backup restore functionality
- CVE-2026-27696 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs
- CVE-2026-33981 Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
Sources
Also known as GHSA-68wj-c2jw-5pp9, PYSEC-2023-10.