CVE-2026-27645: Webtechnologies Changedetection

Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days.

changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. Version 0.54.1 contains a fix for the issue.

Affected products

• Webtechnologies Changedetection: before 0.54.1 (fixed in 0.54.1)

Published 2026-02-25. Last modified 2026-06-17.