CVE-2026-29038 changedetection.io: Reflected XSS in RSS Tag Error Response
Reflected XSS in changedetection.io allows attackers to execute arbitrary JavaScript in victim browsers via the RSS tag endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-29038?
CVE-2026-29038 is a medium-severity cross-site scripting vulnerability in dgtlmoon changedetection.io, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting (XSS) vulnerability identified in the /rss/tag/ endpoint of changedetection.io. The tag_uuid path parameter is reflected directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. This issue has been patched in version 0.54.4.
Weakness: CWE-79
Which versions are affected by CVE-2026-29038?
3 open source packages ship an affected version, including changedetection.io and changedetection-io. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
changedetection.io PyPI | All versions | 0.54.4 |
changedetection-io PyPI | All versions | 0.54.4 |
changedetection-io PyPI | All versions | 0.54.4 |
Products include Webtechnologies Changedetection.
How do I fix CVE-2026-29038?
Upgrade changedetection.io to 0.54.4 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-29038 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-29038 exists.
Other vulnerabilities in dgtlmoon changedetection.io
- CVE-2026-35490 changedetection.io has an Authentication Bypass via Decorator Ordering
- CVE-2026-29039 changedetection.io: XPath - Arbitrary File Read via unparsed-text()
- CVE-2026-29065 changedetection.io: Zip Slip vulnerability in the backup restore functionality
- CVE-2026-27696 changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs
- CVE-2026-33981 Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
Sources
Also known as GHSA-8whx-v8qq-pq64, PYSEC-2026-2127.