Vulnerability Description
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watch_title token is used in templates.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/dgtlmoon/changedetection.io
- https://github.com/dgtlmoon/changedetection.io/blob/0.60.6/changedetectionio/not
- https://github.com/geo-chen/oss/blob/main/changedetection.io.md#finding-1-stored
- https://www.vulncheck.com/advisories/changedetection-io-through-0.60.6-cross-sit
FAQ
What is CVE-2026-92814?
CVE-2026-92814 is a vulnerability with a CVSS score of 4.2 (MEDIUM). changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that ...
How severe is CVE-2026-92814?
CVE-2026-92814 has been rated MEDIUM with a CVSS base score of 4.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92814?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.