CVE-2026-92814

MEDIUM 4.2

changedetection.io through 0.60.6 Cross-Site Scripting via watch_title

CVSS Score

4.2

EPSS Score

0.0%

EPSS Percentile

0th

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.

CWE	CWE-79
Vendor	dgtlmoon
Product	changedetection.io
Published	Sep 16, 2026
Last Updated	Sep 16, 2026

Stay Ahead of the Next One

Get instant alerts for dgtlmoon changedetection.io

Be the first to know when new medium vulnerabilities affecting dgtlmoon changedetection.io are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

dgtlmoon / changedetection.io

0 ≤ 0.60.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/geo-chen/oss/blob/main/changedetection.io.md#finding-1-stored-htmlmarkup-injection-into-html-notifications-via-scraped-page-title-watch_title-not-in-the-escape-set github.com: https://github.com/dgtlmoon/changedetection.io/blob/0.60.6/changedetectionio/notification/handler.py#L400-L414 github.com: https://github.com/dgtlmoon/changedetection.io vulncheck.com: https://www.vulncheck.com/advisories/changedetection-io-through-0.60.6-cross-site-scripting-via-watch-title

Credits

George Chen