CVE-2024-32651 in the critical feed json
Server Side Template Injection in Jinja2 allows Remote Command Execution
published 2024-04-25 2 y ago modified 2026-10-27 13 d ago also EUVD-2024-2939 , GHSA-4r7v-whpg-8rx3 , PYSEC-2026-310
- cvss
- 10.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 85.3%
- EPSS 85.3% chance of exploitation in 30 days, percentile 99.7%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification service. There is a Server Side Template Injection (SSTI) in Jinja2 that allows Remote Command Execution on the server host. Attackers can run any system command without any restriction and they could use a reverse shell. The impact is critical as the attacker can completely takeover the server machine. This can be reduced if changedetection is behind a login page, but this isn't required by the application (not by default and not enforced).
Patch / fix
- pypi changedetection-io 0.45.21
- changedetection changedetection 0.45.21
- webtechnologies changedetection 0.45.21
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
85.26% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Change Detection - Server Side Template Injection nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| OSV | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | changedetection-io | <0.45.21 |
0.45.21 |
Affected products
- dgtlmoon changedetection.io
Classification
- Weakness
-
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
References
-
github.com
/dgtlmoon/changedetection.io/security/advisories/GHSA-4r7v-whpg-8rx3
web
-
github.com
/dgtlmoon/changedetection.io/releases/tag/0.45.21
web
-
onsecurity.io
/blog/server-side-template-injection-with-jinja2
web
- blog.hacktivesecurity.com /index.php/2024/05/08/cve-2024-32651-server-side-template-injection-changedetection-io/
-
nvd.nist.gov
/vuln/detail/CVE-2024-32651
advisory
-
blog.hacktivesecurity.com
/index.php/2024/05/08/cve-2024-32651-server-side-template-injection-changedetection-io
web
-
github.com
/dgtlmoon/changedetection.io
package
-
github.com
/pypa/advisory-database/tree/main/vulns/changedetection-io/PYSEC-2026-310.yaml
web
-
pypi.org
/project/changedetection-io
web, package
-
github.com
/advisories/GHSA-4r7v-whpg-8rx3
advisory
Sources
- CVE List CVE-2024-32651
- GitHub Advisory GHSA-4r7v-whpg-8rx3
- NVD CVE-2024-32651
- OSV PYSEC-2026-310
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.