https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:07:17 +0000 https://cve.radiocsirt.org/vuln/cve-2026-29038 <p><strong>Affected:</strong> dgtlmoon changedetection.io</p> <p>changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting (XSS) vulnerability identified in the /rss/tag/ endpoint of changedetection.io. The tag_uuid path parameter is reflected directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. This issue has been patched in version 0.54.4.</p> <p><strong>Affected:</strong> dgtlmoon changedetection.io</p> <p>changedetection.io is a free open source web page change detection tool. Prior to version 0.54.4, there is a reflected cross-site scripting (XSS) vulnerability identified in the /rss/tag/ endpoint of changedetection.io. The tag_uuid path parameter is reflected directly in the HTTP response body without HTML escaping. Since Flask returns text/html by default for plain string responses, the browser parses and executes injected JavaScript. This issue has been patched in version 0.54.4.</p> https://cve.radiocsirt.org/vuln/cve-2026-29038 https://cve.radiocsirt.org/vuln/ghsa-8whx-v8qq-pq64 <p><strong>Affected:</strong> PyPI: changedetection.io</p> <p>A reflected cross-site scripting (XSS) vulnerability was identified in the `/rss/tag/` endpoint of changedetection.io. The `tag_uuid` path parameter is reflected directly in the HTTP response body without HTML escaping. Since Flask returns `text/html` by default for plain string responses, the browser parses and executes injected JavaScript.</p> <p>This vulnerability persists in version **0.54.1**, which patched the related XSS in `/rss/watch/` (CVE-2026-27645 / GHSA-mw8m-398g-h89w) but did not address the identical pattern in the tag RSS endpoint.</p> <p>## Package</p> <p>- **Ecosystem:** pip - **Package:** changedetection.io - **Affected versions:** &lt;= 0.54.1 - **Patched versions:** _(none yet)_</p> <p>## Severity **Moderate - CVSS 6.1** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`</p> <p>## Details **File:** `changedetectionio/blueprint/rss/tag.py` **Line:** 36 **Source:** [tag.py @ 1d72716](https://raw.githubusercontent.com/dgtlmoon/changedetection.io/1d72716c6988a4f6796bb85a5d42872800cd7a70/changedetectionio/blueprint/rss/tag.py)</p> <p>The `tag_uuid` parameter from the URL path is interpolated into the response body using an f-string with no escaping:</p> <p>```python tag = datastore.data[&#39;settings&#39;][&#39;application&#39;].get(&#39;tags&#39;, {}).get(tag_uuid) if not tag: return f&#34;Tag with UUID {tag_uuid} not found&#34;, 404 # ← No escaping, Content-Type: text/html</p> <p>```</p> <p>Flask&#39;s default `Content-Type` for plain string responses is `text/html; charset=utf-8`, so any HTML/JavaScript injected via `{tag_uuid}` is ren…</p> <p><strong>Affected:</strong> PyPI: changedetection.io</p> <p>A reflected cross-site scripting (XSS) vulnerability was identified in the `/rss/tag/` endpoint of changedetection.io. The `tag_uuid` path parameter is reflected directly in the HTTP response body without HTML escaping. Since Flask returns `text/html` by default for plain string responses, the browser parses and executes injected JavaScript.</p> <p>This vulnerability persists in version **0.54.1**, which patched the related XSS in `/rss/watch/` (CVE-2026-27645 / GHSA-mw8m-398g-h89w) but did not address the identical pattern in the tag RSS endpoint.</p> <p>## Package</p> <p>- **Ecosystem:** pip - **Package:** changedetection.io - **Affected versions:** &lt;= 0.54.1 - **Patched versions:** _(none yet)_</p> <p>## Severity **Moderate - CVSS 6.1** `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`</p> <p>## Details **File:** `changedetectionio/blueprint/rss/tag.py` **Line:** 36 **Source:** [tag.py @ 1d72716](https://raw.githubusercontent.com/dgtlmoon/changedetection.io/1d72716c6988a4f6796bb85a5d42872800cd7a70/changedetectionio/blueprint/rss/tag.py)</p> <p>The `tag_uuid` parameter from the URL path is interpolated into the response body using an f-string with no escaping:</p> <p>```python tag = datastore.data[&#39;settings&#39;][&#39;application&#39;].get(&#39;tags&#39;, {}).get(tag_uuid) if not tag: return f&#34;Tag with UUID {tag_uuid} not found&#34;, 404 # ← No escaping, Content-Type: text/html</p> <p>```</p> <p>Flask&#39;s default `Content-Type` for plain string responses is `text/html; charset=utf-8`, so any HTML/JavaScript injected via `{tag_uuid}` is ren…</p> https://cve.radiocsirt.org/vuln/ghsa-8whx-v8qq-pq64