https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 01:17:37 +0000 https://cve.radiocsirt.org/vuln/cve-2024-32651 <p><strong>Affected:</strong> dgtlmoon changedetection.io</p> <p>changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn&#39;t required by the application (not by default and not enforced).</p> <p><strong>Affected:</strong> dgtlmoon changedetection.io</p> <p>changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn&#39;t required by the application (not by default and not enforced).</p> https://cve.radiocsirt.org/vuln/cve-2024-32651 https://cve.radiocsirt.org/vuln/ghsa-4r7v-whpg-8rx3 <p><strong>Affected:</strong> PyPI: changedetection.io</p> <p>### Summary A Server Side Template Injection in changedetection.io caused by usage of unsafe functions of Jinja2 allows Remote Command Execution on the server host.</p> <p>### Details</p> <p>changedetection.io version: 0.45.20 ``` docker images REPOSITORY TAG IMAGE ID CREATED SIZE dgtlmoon/changedetection.io latest 53529c2e69f1 44 hours ago 423MB ```</p> <p>The vulnerability is caused by the usage of vulnerable functions of Jinja2 template engine. ```python from jinja2 import Environment, BaseLoader ... # Get the notification body from datastore jinja2_env = Environment(loader=BaseLoader) n_body = jinja2_env.from_string(n_object.get(&#39;notification_body&#39;, &#39;&#39;)).render(**notification_parameters) n_title = jinja2_env.from_string(n_object.get(&#39;notification_title&#39;, &#39;&#39;)).render(**notification_parameters) ```</p> <p>### PoC 1. Create/Edit a URL watch item 2. Under *Notifications* tab insert this payload: ```python {{ self.__init__.__globals__.__builtins__.__import__(&#39;os&#39;).popen(&#39;id&#39;).read() }} ``` </p> <p>3. See Telegram (or other supported messaging app) notification</p> <p></p> <p>### Impact In the PoC I&#39;ve used `id` as payload and Telegram to read the result. Attacke…</p> <p><strong>Affected:</strong> PyPI: changedetection.io</p> <p>### Summary A Server Side Template Injection in changedetection.io caused by usage of unsafe functions of Jinja2 allows Remote Command Execution on the server host.</p> <p>### Details</p> <p>changedetection.io version: 0.45.20 ``` docker images REPOSITORY TAG IMAGE ID CREATED SIZE dgtlmoon/changedetection.io latest 53529c2e69f1 44 hours ago 423MB ```</p> <p>The vulnerability is caused by the usage of vulnerable functions of Jinja2 template engine. ```python from jinja2 import Environment, BaseLoader ... # Get the notification body from datastore jinja2_env = Environment(loader=BaseLoader) n_body = jinja2_env.from_string(n_object.get(&#39;notification_body&#39;, &#39;&#39;)).render(**notification_parameters) n_title = jinja2_env.from_string(n_object.get(&#39;notification_title&#39;, &#39;&#39;)).render(**notification_parameters) ```</p> <p>### PoC 1. Create/Edit a URL watch item 2. Under *Notifications* tab insert this payload: ```python {{ self.__init__.__globals__.__builtins__.__import__(&#39;os&#39;).popen(&#39;id&#39;).read() }} ``` </p> <p>3. See Telegram (or other supported messaging app) notification</p> <p></p> <p>### Impact In the PoC I&#39;ve used `id` as payload and Telegram to read the result. Attacke…</p> https://cve.radiocsirt.org/vuln/ghsa-4r7v-whpg-8rx3