The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
MediumVulnerability
GHSA-8whx-v8qq-pq64: changedetection.io has Reflected XSS in its RSS Tag Error Response
- Identifiers
- CVE-2026-29038GHSA-8whx-v8qq-pq64
- Published
- Record updated
- Affected
- changedetection.io < 0.54.4
- Fixed in
- 0.54.4
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
A reflected cross-site scripting flaw exists in the `/rss/tag/` endpoint of changedetection.io, where the `tag_uuid` path parameter is returned in the response body without HTML escaping and served as `text/html`, so injected JavaScript runs in the victim's browser. The issue persists in version 0.54.1, which patched the same pattern in `/rss/watch/` (CVE-2026-27645 / GHSA-mw8m-398g-h89w) but not in the tag endpoint. Affected versions are <= 0.54.1, with no patched version yet listed.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.