GHSA-4c3j-3h7v-22q9

Suggest an improvement
Source
https://github.com/advisories/GHSA-4c3j-3h7v-22q9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-4c3j-3h7v-22q9/GHSA-4c3j-3h7v-22q9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-4c3j-3h7v-22q9
Aliases
Published
2025-11-12T21:24:57Z
Modified
2025-11-12T21:57:39.036110Z
Severity
  • 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
changedetection.io: Stored XSS in Watch update via API
Details

Summary

A Stored Cross Site Scripting is present in the changedetection.io Watch update API due to unsufficient security checks.

Details

Tested on changedetection.io version v0.50.24

REPOSITORY                            TAG       IMAGE ID       CREATED        SIZE
ghcr.io/dgtlmoon/changedetection.io   latest    0367276509a0   23 hours ago   599MB

When a user tries to add an unsafe URL as a Watch in the changedetection.io UI, the action is blocked with the error message "Watch protocol is not permitted by SAFEPROTOCOLREGEX or incorrect URL format". This is catched by the function validate_url(test_url).

def validate_url(test_url):
    # ...
    from .model.Watch import is_safe_url
    if not is_safe_url(test_url):
        # This should be wtforms.validators.
        raise ValidationError('Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format')

When instead the Watch API is used, this check is not performed resulting in unsafe URLs added as Watch.

PoC

Update an existing watch with an unsafe URL

curl -X PUT "http://example.site/api/v1/watch/1242e1c5-d59e-4352-0078-203a55b21282" \
  -H "x-api-key: XXX" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "javascript:alert(document.domain)",
    "title": "XSS PoC",
    "paused": false
  }'

Impact

Two scenarios are possibile:

  1. An attacker can insert a new watch with an arbitrary URL which really points to a web page. Once the HTML content is retrieved, the attacker updates the URL with a JavaScript payload.
  2. An attacker substitutes the URL in an existing watch with a new URL that is in reality a JavaScript payload.

When the user clicks on Preview and then on the malicious link, the JavaScript malicious code is executed.

<img width="1200" height="643" alt="poc1" src="https://github.com/user-attachments/assets/db81e0c7-b6d3-4332-b15d-a688a48c3227" /> <br> <img width="1200" height="643" alt="poc2" src="https://github.com/user-attachments/assets/e704b37c-d339-4322-9fc0-ad50dd86b31d" />

Credits

Edoardo Ottavianelli @edoardottt

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "nvd_published_at": "2025-11-10T22:15:36Z",
    "github_reviewed": true,
    "severity": "LOW",
    "github_reviewed_at": "2025-11-12T21:24:57Z"
}
References

Affected packages

PyPI / changedetection-io

Package

Name
changedetection-io
View open source insights on deps.dev
Purl
pkg:pypi/changedetection-io

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.50.34

Affected versions

0.*

0.38.2
0.39
0.39.1
0.39.2
0.39.3
0.39.4
0.39.5
0.39.6
0.39.7
0.39.8
0.39.9
0.39.10
0.39.10.post1
0.39.10.post2
0.39.11
0.39.12
0.39.13
0.39.13.1
0.39.14
0.39.14.1
0.39.15
0.39.16
0.39.17
0.39.17.1
0.39.17.2
0.39.18
0.39.19
0.39.19.1
0.39.20
0.39.20.1
0.39.20.2
0.39.20.3
0.39.20.4
0.39.21
0.39.21.1
0.39.22
0.39.22.1
0.40.0
0.40.0.1
0.40.0.2
0.40.0.3
0.40.0.4
0.40.1.0
0.40.1.1
0.40.2
0.40.3
0.41
0.41.1
0.42
0.42.1
0.42.2
0.42.3
0.43.1
0.43.2
0.44
0.44.1
0.45
0.45.1
0.45.2
0.45.3
0.45.4
0.45.5
0.45.6
0.45.7
0.45.7.1
0.45.7.2
0.45.7.3
0.45.8
0.45.8.1
0.45.9
0.45.11
0.45.12
0.45.13
0.45.14
0.45.15
0.45.16
0.45.17
0.45.18
0.45.19
0.45.20
0.45.21
0.45.22
0.45.23
0.45.24
0.45.25
0.45.26
0.46.0
0.46.1
0.46.2
0.46.3
0.46.4
0.47.0
0.47.1
0.47.2
0.47.3
0.47.4
0.47.5
0.47.6
0.48.0
0.48.1
0.48.2
0.48.3
0.48.4
0.48.5
0.48.6
0.49.0
0.49.1
0.49.2
0.49.3
0.49.4
0.49.5
0.49.6
0.49.7
0.49.8
0.49.9
0.49.10
0.49.12
0.49.13
0.49.14
0.49.15
0.49.16
0.49.17
0.49.18
0.50.1
0.50.2
0.50.3
0.50.4
0.50.5
0.50.6
0.50.7
0.50.8
0.50.9
0.50.10
0.50.11
0.50.12
0.50.13
0.50.14
0.50.15
0.50.16
0.50.17
0.50.18
0.50.19
0.50.20
0.50.21
0.50.22
0.50.23
0.50.24
0.50.25
0.50.26
0.50.27
0.50.28
0.50.29
0.50.30
0.50.31
0.50.32
0.50.33