CVE-2025-62780
📋 TL;DR
This stored XSS vulnerability in changedetection.io allows attackers to inject malicious JavaScript into watch URLs. When users click Preview on these malicious links, the script executes in their browser context. All users running versions prior to 0.50.34 are affected.
💻 Affected Systems
- changedetection.io
📦 What is this software?
Changedetection by Changedetection
⚠️ Risk & Real-World Impact
Worst Case
Attacker steals session cookies, performs actions as the victim, or redirects to phishing sites leading to account compromise.
Likely Case
Session hijacking, credential theft, or unauthorized actions within the changedetection.io interface.
If Mitigated
Limited impact if proper content security policies and input validation are implemented.
🎯 Exploit Status
Requires authenticated access to create or modify watches. Exploitation is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.50.34
Vendor Advisory: https://github.com/dgtlmoon/changedetection.io/security/advisories/GHSA-4c3j-3h7v-22q9
Restart Required: Yes
Instructions:
1. Backup your configuration and data. 2. Update changedetection.io to version 0.50.34 or later. 3. Restart the changedetection.io service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement strict URL validation to reject JavaScript URLs and suspicious schemes
Content Security Policy
allImplement CSP headers to restrict script execution from untrusted sources
🧯 If You Can't Patch
- Restrict user permissions to prevent unauthorized watch creation/modification
- Implement network segmentation to isolate changedetection.io instances
🔍 How to Verify
Check if Vulnerable:
Check if changedetection.io version is below 0.50.34 in the web interface or configurationCheck Version:
Check web interface settings or docker inspect for version informationVerify Fix Applied:
Confirm version is 0.50.34 or higher and test that JavaScript URLs are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual watch creation/modification patterns
- JavaScript URLs in watch configurations
Network Indicators:
- Unexpected outbound connections from changedetection.io to attacker-controlled domains
SIEM Query:
source="changedetection.io" AND (url="javascript:*" OR url="data:*")