CVE-2024-34061 Reflected cross site scripting in changedetection.io
Attackers can execute arbitrary JavaScript in the context of other users via reflected XSS in the notification_urls parameter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-34061?
CVE-2024-34061 is a medium-severity cross-site scripting vulnerability in dgtlmoon changedetection.io, published on 2 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. In affected versions Input in parameter notification_urls is not processed resulting in javascript execution in the application. A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content. This issue has been addressed in version 0.45.22. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-79
Which versions are affected by CVE-2024-34061?
3 open source packages ship an affected version, including changedetection.io and changedetection-io.
| Package | Affected | Fixed in |
|---|---|---|
changedetection.io PyPI | All versions | 0.45.22 |
changedetection-io PyPI | All versions | 0.45.22 |
changedetection-io PyPI | All versions | 0.45.22 |
How do I fix CVE-2024-34061?
Upgrade changedetection.io to 0.45.22 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-34061 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34061 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-pwgc-w4x9-gw67, PYSEC-2026-1243.