CVE-2026-92814

Overview

Changedetection.io versions up to 0.60.6 do not properly escape page titles when generating HTML notifications. This flaw allows an attacker to inject arbitrary markup into email or Telegram alerts that use the `watch_title` token, potentially leading to cross‑site scripting or phishing attacks.

Description

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.

Impact

{'confidentiality': 'Potential exposure of sensitive data if an attacker uses the injected markup to harvest credentials or session information.', 'integrity': 'Malicious content can alter the appearance or behavior of notifications, misleading users or redirecting them to malicious sites.', 'availability': 'No direct impact on service availability, but compromised notifications could erode user trust.'}

Remediation

['Upgrade to the latest version of Changedetection.io (≥\u202f0.60.7) where the title is properly escaped.', 'If an upgrade is not immediately possible, disable the use of the `watch_title` token in notification templates or manually escape the title before rendering.', 'Implement server‑side output sanitization for all user‑controlled fields that appear in HTML notifications.', 'Audit and monitor outgoing notifications for unexpected markup or links.']

Risk context

The vulnerability is rated medium (CVSS v3 4.2, CVSS v4 2.3) with no EPSS data. While it does not compromise the core application directly, it enables attackers to deliver malicious content via legitimate notification channels, warranting prompt patching or mitigation.

Affected products

• changedetection.io 0.60.6 and earlier