# CVE-2025-62780: changedetection.io Stored XSS in Watch update via API

Source: https://junglewise.ai/threats/cve-2025-62780-changedetection-io-stored-xss-in-watch-update-via-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-12. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2025-62780 · Severity: low · CVSS 3.5 · Published 2025-11-12

changedetection.io is a tool used to monitor websites for changes. A security flaw allows an attacker with API access to inject malicious scripts into the system by bypassing URL safety checks. If an administrator previews a compromised monitor, the script could execute in their browser, potentially leading to unauthorized actions or data theft.

Technologies: [changedetection.io (PyPI)](https://junglewise.ai/threats/technologies/changedetection-io). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-62780 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-62780 being exploited in the wild.

**How severe is CVE-2025-62780?** Low severity, with a CVSS score of 3.5, published 12 November 2025.

**Which products and versions are affected?** changedetection.io (PyPI) < 0.50.34, ECOSYSTEM:introduced=0,fixed=0.50.34.

**Is there a fix for CVE-2025-62780?** Yes. changedetection.io (PyPI): upgrade to 0.50.34 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-62780 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-62780?** Check whether you run changedetection.io (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- changedetection.io (PyPI): upgrade to 0.50.34 or later

  ```sh
  pip install "changedetection.io>=0.50.34"
  ```


## Technical details

A stored cross-site scripting (XSS) vulnerability exists in changedetection.io due to inconsistent input validation between the web UI and the API. While the UI correctly validates URLs using the `validate_url` function and `is_safe_url` check, the Watch update API (v1) fails to perform these checks. An attacker with a valid API key can update a watch's URL to a 'javascript:' payload. When a user subsequently interacts with the 'Preview' link for that watch in the web interface, the malicious JavaScript is executed in the context of the user's session. This issue is fixed in version 0.50.34.

## Affected products

- dgtlmoon changedetection.io < 0.50.34

## Identifiers

- CVE-2025-62780
- GHSA-4c3j-3h7v-22q9
- PYSEC-2025-91

## Timeline

- 2025-11-10: disclosed
- 2025-11-10: patched: Version 0.50.34 released
- 2025-11-12: advisory

## References

- [https://api.github.com/users/edoardottt](https://api.github.com/users/edoardottt)
- [https://github.com/edoardottt](https://github.com/edoardottt)
- [https://api.github.com/users/edoardottt/gists%7B/gist_id%7D](https://api.github.com/users/edoardottt/gists%7B/gist_id%7D)
- [https://api.github.com/users/edoardottt/repos](https://api.github.com/users/edoardottt/repos)
- [https://avatars.githubusercontent.com/u/35783570?v=4](https://avatars.githubusercontent.com/u/35783570?v=4)
- [https://api.github.com/users/edoardottt/events%7B/privacy%7D](https://api.github.com/users/edoardottt/events%7B/privacy%7D)

## Related threats

- [dgtlmoon changedetection.io path traversal in static content route](https://junglewise.ai/threats/cve-2026-25527-dgtlmoon-changedetection-io-path-traversal-in-static-content)
- [PYSEC-2026-1241 - ChangeDetection.io XSS in watch overview](https://junglewise.ai/threats/cve-2025-52558-changedetection-io-xss-in-watch-overview)
- [PYSEC-2026-1242 - changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal](https://junglewise.ai/threats/cve-2024-56509-changedetection-io-vulnerable-to-improper-input-validation)
- [PYSEC-2026-1239 - changedetection.io path traversal using file URI scheme without supplying hostname](https://junglewise.ai/threats/cve-2024-51998-changedetection-io-path-traversal-using-file-uri-scheme-without)
- [PYSEC-2026-1240 - changedetection.io Path Traversal](https://junglewise.ai/threats/cve-2024-51483-changedetection-io-path-traversal)