CVE-2025-52558High▾ TwilightChangeDetection.io XSS in watch overview
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.5%
0.5% → 0.6%
XSS - Errors in filters from website page change detection watches were not being filtered.
0.50.4
changedetection-io < 0.50.4Upgrade to a patched release:
changedetection-io 0.50.4Connected by shared product, vendor, weakness, or advisory.
CVE-2024-23329Low· 3.7changedetection.io API endpoint is not secured with API token
CVE-2024-32651Critical· 10.0changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
CVE-2026-27645Medium· 6.1changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
CVE-2026-29038Medium· 6.1changedetection.io has Reflected XSS in its RSS Tag Error Response
CVE-2026-29039Highchangedetection.io vulnerable to XPath - Arbitrary File Read via unparsed-text()
CVE-2026-33981HighChangedetection.io Discloses Environment Variables via jq env Builtin in Include Filters