Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/changedetection.io@0.53.7
Typepypi
Namespace
Namechangedetection.io
Version0.53.7
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version0.54.1
Latest_non_vulnerable_version0.54.4
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-rtc8-dk2w-sqcm
vulnerability_id VCID-rtc8-dk2w-sqcm
summary 
changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response
Three security vulnerabilities were identified in [changedetection.io](http://changedetection.io/) through source code review and live validation against a locally deployed Docker instance. All vulnerabilities were confirmed exploitable on the latest version (0.53.6) it was additionally validated at scale against 500 internet-facing instances discovered via FOFA search engine, producing 5K+ confirmed detections using a custom Nuclei template, demonstrating widespread real-world impact.
The RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript.
references
0
reference_url https://github.com/dgtlmoon/changedetection.io
reference_id
reference_type
scores
url https://github.com/dgtlmoon/changedetection.io
1
reference_url https://github.com/dgtlmoon/changedetection.io/commit/a385c89abf44b52fcfa20c7c6a6dd3047c4c1eb5
reference_id
reference_type
scores
url https://github.com/dgtlmoon/changedetection.io/commit/a385c89abf44b52fcfa20c7c6a6dd3047c4c1eb5
2
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-27645
reference_id CVE-2026-27645
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2026-27645
3
reference_url https://github.com/advisories/GHSA-mw8m-398g-h89w
reference_id GHSA-mw8m-398g-h89w
reference_type
scores
url https://github.com/advisories/GHSA-mw8m-398g-h89w
4
reference_url https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-mw8m-398g-h89w
reference_id GHSA-mw8m-398g-h89w
reference_type
scores
url https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-mw8m-398g-h89w
fixed_packages
0
url pkg:pypi/changedetection.io@0.53.7
purl pkg:pypi/changedetection.io@0.53.7
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/changedetection.io@0.53.7
aliases CVE-2026-27645, GHSA-mw8m-398g-h89w
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-rtc8-dk2w-sqcm
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/changedetection.io@0.53.7