CVE-2026-92814

changedetection.io through 0.60.6 Cross-Site Scripting via watch_title

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.

Affected

dgtlmoon · changedetection.io

CVSS v4.0 VULNCHECK

2.3 LOWCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULNCHECK

4.2 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS

0.30% chance of exploitation in the next 30 days, 21st percentile

Published

2026-09-16

Updated

2026-09-17

Proof-of-concept exploits (1)

• geo-chen/oss/blob/main/changedetection.io.md#finding-1-stored-htmlmarkup-injection-into-h…

References

• CVE Record
• NVD entry