MEDIUM6.1

PYSEC-2026-2127

Quick fix

PYSEC-2026-2127 — changedetection-io: upgrade to the fixed version with the command below.

pip install --upgrade 'changedetection-io>=0.54.4'

Details

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting (XSS) vulnerability identified in the /rss/tag/ endpoint of changedetection.io. The tag_uuid path parameter is reflected directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. This issue has been patched in version 0.54.4.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/changedetection-io

Introduced in: 0Fixed in: 0.54.4

Fixpip install --upgrade 'changedetection-io>=0.54.4'

References

https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4[ADVISORY]
https://github.com/dgtlmoon/changedetection.io/commit/ec7d56f85d1e9690fca7cb4711c1fb20dffec780[FIX]
https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-8whx-v8qq-pq64[EVIDENCE]