Is CVE-2025-62780 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-62780 being exploited in the wild.

How severe is CVE-2025-62780?

Low severity, with a CVSS score of 3.5, published 12 November 2025.

Which products and versions are affected?

changedetection.io (PyPI) < 0.50.34, ECOSYSTEM:introduced=0,fixed=0.50.34.

Is there a fix for CVE-2025-62780?

Yes. changedetection.io (PyPI): upgrade to 0.50.34 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-62780 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-62780?

Check whether you run changedetection.io (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-62780: changedetection.io Stored XSS in Watch update via API

Q: Is there a fix for CVE-2025-62780?

Yes. changedetection.io (PyPI): upgrade to 0.50.34 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-62780 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2025-62780?

Check whether you run changedetection.io (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-62780 · Severity: low · CVSS 3.5 · Published 2025-11-12

changedetection.io is a tool used to monitor websites for changes. A security flaw allows an attacker with API access to inject malicious scripts into the system by bypassing URL safety checks. If an administrator previews a compromised monitor, the script could execute in their browser, potentially leading to unauthorized actions or data theft.

Technologies: changedetection.io (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-62780 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-62780 being exploited in the wild.
How severe is CVE-2025-62780?: Low severity, with a CVSS score of 3.5, published 12 November 2025.
Which products and versions are affected?: changedetection.io (PyPI) < 0.50.34, ECOSYSTEM:introduced=0,fixed=0.50.34.
Is there a fix for CVE-2025-62780?: Yes. changedetection.io (PyPI): upgrade to 0.50.34 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-62780 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-62780?: Check whether you run changedetection.io (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

changedetection.io (PyPI): upgrade to 0.50.34 or later
```
pip install "changedetection.io>=0.50.34"
```

Technical details

A stored cross-site scripting (XSS) vulnerability exists in changedetection.io due to inconsistent input validation between the web UI and the API. While the UI correctly validates URLs using the `validate_url` function and `is_safe_url` check, the Watch update API (v1) fails to perform these checks. An attacker with a valid API key can update a watch's URL to a 'javascript:' payload. When a user subsequently interacts with the 'Preview' link for that watch in the web interface, the malicious JavaScript is executed in the context of the user's session. This issue is fixed in version 0.50.34.

Affected products

dgtlmoon changedetection.io < 0.50.34

Identifiers

CVE-2025-62780
GHSA-4c3j-3h7v-22q9
PYSEC-2025-91

Timeline

2025-11-10: disclosed
2025-11-10: patched: Version 0.50.34 released
2025-11-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.