PYSEC-2026-1243

### Summary

Input in parameter notification_urls is not processed resulting in javascript execution in the application

### Details changedetection.io version: v0.45.21

https://github.com/dgtlmoon/changedetection.io/blob/0.45.21/changedetectionio/forms.py#L226

``` for server_url in field.data: if not apobj.add(server_url): message = field.gettext('\'%s\' is not a valid AppRise URL.' % (server_url)) raise ValidationError(message) ```

### PoC

Setting > ADD Notification URL List


``` "><img src=x onerror=alert(document.domain)> ``` 

Requests


### Impact A reflected XSS vulnerability happens when the user input from a URL or POST data is reflected on the page without being stored, thus allowing the attacker to inject malicious content