# changedetection-io (PyPI) vulnerabilities 20 known vulnerabilities (2 critical, 10 high, 6 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.70.2 (Nov 5, 2026): no advisory affects it - Newest unaffected release: 0.70.2 (Nov 5, 2026), the latest release - Weekly downloads: 4,860 - Dependents: 2 - Releases: 215 since 0.38.2 (Aug 16, 2021) - Registry: https://pypi.org/project/changedetection-io/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-43891: 0.38.2 to 0.54.10 (0.55.1 is outside it) - CVE-2026-41895: 0.38.2 to 0.54.9 (0.54.10 is outside it) - CVE-2026-35490: 0.38.2 to 0.54.7 (0.54.8 is outside it) - CVE-2026-35000: 0.38.2 to 0.54.6 (0.54.7 is outside it) - CVE-2026-33981: 0.38.2 to 0.54.6 (0.54.7 is outside it) - CVE-2026-29065: 0.38.2 to 0.54.3 (0.54.4 is outside it) - CVE-2026-29039: 0.38.2 to 0.54.3 (0.54.4 is outside it) - CVE-2026-29038: 0.38.2 to 0.54.3 (0.54.4 is outside it) - CVE-2026-27696: 0.38.2 to 0.53.7 (0.54.1 is outside it) - CVE-2026-27645: 0.38.2 to 0.53.7 (0.54.1 is outside it) - CVE-2026-25527: 0.38.2 to 0.53.1 (0.53.2 is outside it) - CVE-2025-62780: 0.38.2 to 0.50.33 (0.50.34 is outside it) - CVE-2025-52558: 0.38.2 to 0.50.3 (0.50.4 is outside it) - CVE-2024-56509: 0.38.2 to 0.48.4 (0.48.5 is outside it) - CVE-2024-51998: 0.38.2 to 0.47.5 (0.47.6 is outside it) - CVE-2024-51483: 0.38.2 to 0.47.4 (0.47.5 is outside it) - CVE-2024-34061: 0.38.2 to 0.45.21 (0.45.22 is outside it) - CVE-2024-32651: 0.38.2 to 0.45.20 (0.45.21 is outside it) - CVE-2024-23329: 0.39.14 to 0.45.12 (0.45.13 is outside it) - CVE-2023-24769: 0.38.2 to 0.40.1.1 (0.40.2 is outside it) ## Advisories (20) ### [CVE-2026-43891](https://cve.now/CVE-2026-43891): changedetection.io: Arbitrary Local File Read via crafted backup restore - Severity: High 7.5 - Published: May 12, 2026 - Affected: fixed in 0.55.1. - Fixed in 0.55.1 (released Apr 27, 2026, 15 days before disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2026-41895](https://cve.now/CVE-2026-41895): changedetection.io: XXE vulnerability in the changedetection.io project - Severity: High 8.2 - Published: May 12, 2026 - Affected: through 0.54.9; fixed in 0.54.10. - Fixed in 0.54.10 (released Apr 20, 2026, 22 days before disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2026-35490](https://cve.now/CVE-2026-35490): changedetection.io has an Authentication Bypass via Decorator Ordering - Severity: Critical 9.8 - Published: Apr 7, 2026 - Affected: fixed in 0.54.8. - Fixed in 0.54.8 (released Apr 4, 2026, 3 days before disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2026-35000](https://cve.now/CVE-2026-35000): ChangeDetection.io \< 0.54.7 SafeXPath3Parser Bypass Arbitrary File Read - Severity: High 7.1 - Published: Apr 1, 2026 - Affected: fixed in 0.54.7. - Fixed in 0.54.7 (released Mar 26, 2026, 6 days before disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2026-33981](https://cve.now/CVE-2026-33981): Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters - Severity: High 8.3 - Published: Mar 27, 2026 - Affected: fixed in 0.54.7. - Fixed in 0.54.7 (released Mar 26, 2026, 1 day before disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2026-29065](https://cve.now/CVE-2026-29065): changedetection.io: Zip Slip vulnerability in the backup restore functionality - Severity: High 8.8 - Published: Mar 6, 2026 - Affected: fixed in 0.54.4. - Fixed in 0.54.4 (released Mar 4, 2026, 2 days before disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2026-29039](https://cve.now/CVE-2026-29039): changedetection.io: XPath - Arbitrary File Read via unparsed-text() - Severity: High 8.8 - Published: Mar 6, 2026 - Affected: fixed in 0.54.4. - Fixed in 0.54.4 (released Mar 4, 2026, 2 days before disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2026-29038](https://cve.now/CVE-2026-29038): changedetection.io: Reflected XSS in RSS Tag Error Response - Severity: Medium 6.1 - Published: Mar 6, 2026 - Affected: fixed in 0.54.4. - Fixed in 0.54.4 (released Mar 4, 2026, 2 days before disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2026-27696](https://cve.now/CVE-2026-27696): changedetection.io Vulnerable to Server-Side Request Forgery (SSRF) via Watch URLs - Severity: High 8.6 - Published: Feb 25, 2026 - Affected: fixed in 0.54.1. - Fixed in 0.54.1 (released Feb 23, 2026, 2 days before disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2026-27645](https://cve.now/CVE-2026-27645): changedetection.io Vulnerable to Reflected XSS in RSS Single Watch Error Response - Severity: Medium 6.1 - Published: Feb 25, 2026 - Affected: fixed in 0.54.1; fixed in 0.53.7. - Fixed in 0.54.1 (released Feb 23, 2026, 2 days before disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2026-25527](https://cve.now/CVE-2026-25527): changedetection.io vulnerable to unauthenticated static path traversal - Severity: Medium 5.3 - Published: Feb 19, 2026 - Affected: fixed in 0.53.2. - Fixed in 0.53.2 (released Feb 16, 2026, 3 days before disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2025-62780](https://cve.now/CVE-2025-62780): changedetection.io vulnerable to stored XSS in Watch update via API - Severity: Low 3.5 - Published: Nov 10, 2025 - Affected: fixed in 0.50.34. - Fixed in 0.50.34 (released Oct 28, 2025, 13 days before disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2025-52558](https://cve.now/CVE-2025-52558): ChangeDetection.io XSS in watch overview - Severity: High 7.0 - Published: Jun 23, 2025 - Affected: fixed in 0.50.4. - Fixed in 0.50.4 (released Jun 21, 2025, 2 days before disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2024-56509](https://cve.now/CVE-2024-56509): changedetection.io has Improper Input Validation Leading to LFR/Path Traversal - Severity: High 8.6 - Published: Dec 27, 2024 - Affected: fixed in 0.48.05. - Fixed in 0.48.5 (released Dec 27, 2024, the day of disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2024-51998](https://cve.now/CVE-2024-51998): Path traversal using file URI scheme without supplying hostname in changedetection.io - Severity: High 8.6 - Published: Nov 7, 2024 - Affected: fixed in 0.47.6. - Fixed in 0.47.6 (released Nov 7, 2024, the day of disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2024-51483](https://cve.now/CVE-2024-51483): changedetection.io Path Traversal vulnerability - Severity: Medium 6.9 - Published: Nov 1, 2024 - Affected: fixed in 0.47.5. - Fixed in 0.47.5 (released Oct 31, 2024, 1 day before disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2024-34061](https://cve.now/CVE-2024-34061): Reflected cross site scripting in changedetection.io - Severity: Medium 4.3 - Published: May 2, 2024 - Affected: fixed in 0.45.22. - Fixed in 0.45.22 (released May 2, 2024, the day of disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2024-32651](https://cve.now/CVE-2024-32651): Server Side Template Injection in Jinja2 allows Remote Command Execution - Severity: Critical 10.0 - Published: Apr 25, 2024 - Affected: fixed in 0.45.21. - Fixed in 0.45.21 (released Apr 25, 2024, the day of disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2024-23329](https://cve.now/CVE-2024-23329): changedetection.io API endpoint is not secured with API token - Severity: Low 3.7 - Published: Jan 19, 2024 - Affected: from 0.39.14, fixed in 0.45.13. - Fixed in 0.45.13 (released Jan 19, 2024, the day of disclosure). - The latest release, 0.70.2, is not affected. ### [CVE-2023-24769](https://cve.now/CVE-2023-24769): Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page. - Severity: Medium 5.4 - Published: Feb 17, 2023 - Affected: fixed in 0.40.2; fixed in 0.40.1.1. - Fixed in 0.40.2 (released Feb 3, 2023, 14 days before disclosure). - The latest release, 0.70.2, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/changedetection-io Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.