changedetection.io: Stored XSS in Watch update via API
Summary
A Stored Cross Site Scripting is present in the changedetection.io Watch update API due to unsufficient security checks.
Details
Tested on changedetection.io version v0.50.24
REPOSITORY TAG IMAGE ID CREATED SIZE
ghcr.io/dgtlmoon/changedetection.io latest 0367276509a0 23 hours ago 599MBWhen a user tries to add an unsafe URL as a Watch in the changedetection.io UI, the action is blocked with the error message "Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format".
This is catched by the function validate_url(test_url).
def validate_url(test_url):
# ...
from .model.Watch import is_safe_url
if not is_safe_url(test_url):
# This should be wtforms.validators.
raise ValidationError('Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format')When instead the Watch API is used, this check is not performed resulting in unsafe URLs added as Watch.
PoC
Update an existing watch with an unsafe URL
curl -X PUT "http://example.site/api/v1/watch/1242e1c5-d59e-4352-0078-203a55b21282" \
-H "x-api-key: XXX" \
-H "Content-Type: application/json" \
-d '{
"url": "javascript:alert(document.domain)",
"title": "XSS PoC",
"paused": false
}'Impact
Two scenarios are possibile:
- An attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload.
- An attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload.
When the user clicks on Preview and then on the malicious link, the JavaScript malicious code is executed.
<img width="1200" height="643" alt="poc1" src="https://github.com/user-attachments/assets/db81e0c7-b6d3-4332-b15d-a688a48c3227" /> <br> <img width="1200" height="643" alt="poc2" src="https://github.com/user-attachments/assets/e704b37c-d339-4322-9fc0-ad50dd86b31d" />Credits
Edoardo Ottavianelli @edoardottt
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | changedetection-io | < 0.50.34 | 0.50.34 |
Referencias
- https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4c3j-3h7v-22q9
- https://nvd.nist.gov/vuln/detail/CVE-2025-62780
- https://github.com/dgtlmoon/changedetection.io/issues/3562
- https://github.com/dgtlmoon/changedetection.io/pull/3564
- https://github.com/dgtlmoon/changedetection.io
- https://github.com/dgtlmoon/changedetection.io/releases/tag/0.50.34
- https://github.com/pypa/advisory-database/tree/main/vulns/changedetection-io/PYSEC-2025-91.yaml
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N- Debilidad (CWE)
CWE-79- Plataforma
- Python (PyPI)
- Paquete
changedetection-io- Publicada
- 10.11.2025
- Actualizado
- 11.10.2026 12:19
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2025-91 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-4c3j-3h7v-22q9 - CC BY 4.0
Historial de vulnerabilidades: changedetection-io
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 20
- Primera → última
- 02.2023 05.2026
- Sin corrección
- 1
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 2
- Alta 9
- Media 6
- Baja 2
- Sin evaluar 1
Divulgaciones por año
- 2023: 1
- 2024: 6
- 2025: 2
- 2026: 11
-
changedetection.io: Stored XSS in Watch update via API esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.