CVE-2026-27645 changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
Attackers can execute arbitrary JavaScript in victims' browsers via reflected XSS in the RSS single-watch endpoint of changedetection.io.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-27645?
CVE-2026-27645 is a medium-severity cross-site scripting vulnerability in dgtlmoon changedetection.io, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. Version 0.54.1 contains a fix for the issue.
Weakness: CWE-79
Which versions are affected by CVE-2026-27645?
3 open source packages ship an affected version, including changedetection.io and changedetection-io. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
changedetection.io PyPI | All versions | 0.53.7 |
changedetection-io PyPI | All versions | 0.53.7 |
changedetection-io PyPI | All versions | 0.54.1 |
Products include Webtechnologies Changedetection.
How do I fix CVE-2026-27645?
Upgrade changedetection.io to 0.53.7 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-27645 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27645 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in dgtlmoon changedetection.io
- CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering
- CVE-2026-29039 changedetection.io: XPath - Arbitrary File Read via unparsed-text()
- CVE-2026-29065 changedetection.io: Zip Slip vulnerability in the backup restore functionality
- CVE-2026-27696 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs
- CVE-2026-33981 Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
Sources
Also known as GHSA-mw8m-398g-h89w, PYSEC-2026-2125.