PT-2026-21866 · Unknown · Changedetection.Io

Akokonunes + 1 · Published 2026-02-25 · Updated 2026-03-12 · CVE-2026-27645

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions changedetection.io versions prior to 0.54.1

Description The application reflects the UUID path parameter directly in the HTTP response body without HTML escaping in the RSS single-watch endpoint. Because Flask defaults to returning text/html for plain string responses, the browser parses and executes injected JavaScript. This could allow for potential cross-site scripting (XSS) attacks.

Recommendations Update to version 0.54.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27645

GHSA-MW8M-398G-H89W

Affected Products

Changedetection.Io

References · 12

• 🔥 https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-mw8m-398g-h89w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27645.json · Exploit
• https://github.com/dgtlmoon/changedetection.io/commit/a385c89abf44b52fcfa20c7c6a6dd3047c4c1eb5 · Patch
• https://osv.dev/vulnerability/CVE-2026-27645 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27645 · Security Note
• https://osv.dev/vulnerability/GHSA-mw8m-398g-h89w · Vendor Advisory
• https://github.com/dgtlmoon/changedetection.io · Note
• https://t.me/CVEtracker/45694 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2032139592405827802 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026701651030032798 · Twitter Post
• https://t.me/cveNotify/153103 · Telegram Post
• https://twitter.com/CVEnew/status/2026641343615733944 · Twitter Post