Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuard View on GitHub

GHSA-4c3j-3h7v-22q9

LowCVSS 3.5 / 10

Published Nov 12, 2025·Last modified Nov 12, 2025

Affected Components(0)

No affected components available

Description

Summary

A Stored Cross Site Scripting is present in the changedetection.io Watch update API due to unsufficient security checks.

Details

Tested on changedetection.io version v0.50.24

REPOSITORY                            TAG       IMAGE ID       CREATED        SIZE
ghcr.io/dgtlmoon/changedetection.io   latest    0367276509a0   23 hours ago   599MB

When a user tries to add an unsafe URL as a Watch in the changedetection.io UI, the action is blocked with the error message "Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format". This is catched by the function validate_url(test_url).

def validate_url(test_url):
    # ...
    from .model.Watch import is_safe_url
    if not is_safe_url(test_url):
        # This should be wtforms.validators.
        raise ValidationError('Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format')

When instead the Watch API is used, this check is not performed resulting in unsafe URLs added as Watch.

PoC

Update an existing watch with an unsafe URL

curl -X PUT "http://example.site/api/v1/watch/1242e1c5-d59e-4352-0078-203a55b21282" \
  -H "x-api-key: XXX" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "javascript:alert(document.domain)",
    "title": "XSS PoC",
    "paused": false
  }'

Impact

Two scenarios are possibile:

An attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload.
An attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload.

When the user clicks on Preview and then on the malicious link, the JavaScript malicious code is executed.

Credits

Edoardo Ottavianelli @edoardottt

Risk Scores

Base Score

3.5

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs high-level or administrative privileges. The attacker needs the user to perform some action, like clicking a link. The impact is confined to the system where the vulnerability exists. There is a low impact on the confidentiality of the information. There is a low impact on the integrity of the data.

Threat Intelligence

3.2

Limited exploitation activity has been observed. Close monitoring and planned remediation are recommended.

EPSS

0.44%

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit

Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Related Vulnerabilities

Browse More

Low severity

Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard