https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T15:07:28.993646+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-29038 CVE-2026-29038 — changedetection.io: Reflected XSS in RSS Tag Error Response 2026-10-02T15:07:28.995506+00:00

Affected: dgtlmoon changedetection.io

changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting (XSS) vulnerability identified in the /rss/tag/ endpoint of changedetection.io. The tag_uuid path parameter is reflected directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. This issue has been patched in version 0.54.4.

 https://cve.radiocsirt.org/vuln/ghsa-8whx-v8qq-pq64 GHSA-8whx-v8qq-pq64 — changedetection.io has Reflected XSS in its RSS Tag Error Response 2026-10-02T15:07:28.995579+00:00

Affected: PyPI: changedetection.io

A reflected cross-site scripting (XSS) vulnerability was identified in the `/rss/tag/` endpoint of changedetection.io. The `tag_uuid` path parameter is reflected directly in the HTTP response body without HTML escaping. Since Flask returns `text/html` by default for plain string responses, the browser parses and executes injected JavaScript.

This vulnerability persists in version **0.54.1**, which patched the related XSS in `/rss/watch/` (CVE-2026-27645 / GHSA-mw8m-398g-h89w) but did not address the identical pattern in the tag RSS endpoint.

## Package

- **Ecosystem:** pip - **Package:** changedetection.io - **Affected versions:** <= 0.54.1 - **Patched versions:** _(none yet)_

## Severity **Moderate - CVSS 6.1** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

## Details **File:** `changedetectionio/blueprint/rss/tag.py` **Line:** 36 **Source:** [tag.py @ 1d72716](https://raw.githubusercontent.com/dgtlmoon/changedetection.io/1d72716c6988a4f6796bb85a5d42872800cd7a70/changedetectionio/blueprint/rss/tag.py)

The `tag_uuid` parameter from the URL path is interpolated into the response body using an f-string with no escaping:

```python tag = datastore.data['settings']['application'].get('tags', {}).get(tag_uuid) if not tag: return f"Tag with UUID {tag_uuid} not found", 404 # ← No escaping, Content-Type: text/html

```

Flask's default `Content-Type` for plain string responses is `text/html; charset=utf-8`, so any HTML/JavaScript injected via `{tag_uuid}` is ren…