Executive brief
changedetection.io is a web page monitoring tool that tracks content changes and sends alerts via email and messaging platforms. When monitoring a webpage, the tool fails to sanitize page titles before injecting them into HTML notification emails, allowing attackers to embed arbitrary HTML/JavaScript code that executes in email clients or messaging platforms when notifications are sent.
Technical details
The vulnerability is an HTML/markup injection flaw in the notification handler (notification/handler.py) where scraped page titles are inserted unsanitized into HTML email templates. When a monitored page's title contains malicious markup and the watch_title token is used in notification templates, the attacker-controlled content is rendered as live HTML in the notification message. This affects notification channels including email and Telegram. No authentication is required to exploit this—attackers can inject code by controlling the title of a webpage being monitored. A patch is available in versions later than 0.60.6.
Affected products
- changedetection.io changedetection.io through 0.60.6
Timeline
- 2026-09-16: disclosed