PyPI/changedetection-io CVE-2026-29038: medium 6.1, EPSS 0.29%

changedetection.io has Reflected XSS in its RSS Tag Error Response

Action: Upgrade changedetection-io to 0.54.4 or later.

pip install changedetection-io==0.54.4

Affected

Fixed versions

Sources

• osv: GHSA-8whx-v8qq-pq64
• https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-8whx-v8qq-pq64
• https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-mw8m-398g-h89w
• https://nvd.nist.gov/vuln/detail/CVE-2026-29038
• https://github.com/dgtlmoon/changedetection.io/commit/ec7d56f85d1e9690fca7cb4711c1fb20dffec780
• https://github.com/dgtlmoon/changedetection.io
• https://github.com/dgtlmoon/changedetection.io/releases/tag/0.54.4

CVE-2026-29038 · published 2026-03-04T20:58:14Z · modified 2026-07-13T07:26:50.318400804Z · JSON