changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. Version 0.54.1 contains a fix for the issue.

Affected: PyPI: changedetection.io

### Summary Three security vulnerabilities were identified in [changedetection.io](http://changedetection.io/) through source code review and live validation against a locally deployed Docker instance. All vulnerabilities were confirmed exploitable on the latest version (0.53.6) it was additionally validated at scale against 500 internet-facing instances discovered via FOFA search engine, producing 5K+ confirmed detections using a custom Nuclei template, demonstrating widespread real-world impact. The RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript.

### Details File: `changedetectionio/blueprint/rss/single_watch.py (lines ~45 and ~50)`

The UUID parameter from the URL path is interpolated into the response body using an f-string with no escaping:

### Line ~45 ``` watch = datastore.data['watching'].get(uuid) if not watch: return f"Watch with UUID {uuid} not found", 404 # ← No escaping, Content-Type: text/html ```

### Line ~50 ``` if len(dates) < 2: return f"Watch {uuid} does not have enough history snapshots...", 400 # ← Same issue Flask's default Content-Type for plain string responses is text/html; charset=utf-8, so any HTML/JavaScript in {uuid} is rendered by the browser. ```

## Attack Vector The attack requires a valid RSS access token, which is a 32-character hex string…

Affected: PyPI: changedetection-io

changedetection.io is a free open source web page change detection tool. In versions prior to 0.54.1, the RSS single-watch endpoint reflects the UUID path parameter directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. Version 0.54.1 contains a fix for the issue.