changedetection.io: Stored XSS in Watch update via API
Date: 2025-11
Affected: pip/changedetection.io
Attack vector: xss
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2025-62780
CWE: CWE-79
CVSS: 3.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N)

### Summary A Stored Cross Site Scripting is present in the changedetection.io Watch update API due to unsufficient security checks. ### Details Tested on changedetection.io version *v0.50.24* ```console REPOSITORY TAG IMAGE ID CREATED SIZE ghcr.io/dgtlmoon/changedetection.io latest 0367276509a0 23 hours ago 599MB ``` When a user tries to add an unsafe URL as a Watch in the changedetection.io UI, the action is blocked with the error message "Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format". This is catched by the function `validate_url(test_url)`. ```python def validate_url(test_url): # ... from .model.Watch import is_safe_url if not is_safe_url(test_url): # This should be wtforms.validators. raise ValidationError('Watch protocol is not permitted by SAFE_PROTOCOL_REGEX or incorrect URL format') ``` When instead the Watch API is used, this check is not performed resulting in unsafe URLs added as Watch. ### PoC Update an existing watch with an unsafe URL ```console curl -X PUT "http://example.site/api/v1/watch/1242e1c5-d59e-4352-0078-203a55b21282" \ -H "x-api-key: XXX" \ -H "Content-Type: application/json" \ -d '{ "url": "javascript:alert(document.domain)", "title": "XSS PoC", "paused": false }' ``` ### Impact Two scenarios are possibile: 1. An attacker can insert a new watch with an arbitrary URL which really points to a web page. On


Mitigations:

Architectural layers (MAESTRO):